yeah, this was my main annoyance with it, i don't log into my server for months at a time so i wanted something without constant updates but other than that it was fine.
I know at least one other person who runs Arch on all their servers, they do an update monthly unless there's some critical CVE that needs to be addressed ASAP. The sibling comment says 1 year, but I can't honestly suggest going that long for any distro. I've had Ubuntu LTS break very, very badly because of a missed patch in GRUB when updating over too long of a timescale (somewhere around a year, maybe a bit less)
I update one of my servers once a year or even longer, and it’s still doing fine with Arch.