I don’t follow CVEs: when was the last time a remotely exploitable kernel bug was a concern? Ignoring the fact that this is a home server and they likely care about uptime a lot more than exploitation on their LAN.

Generally I expect kernel bugs to be LPEs so updating user space would probably be sufficient for most home servers