Speaking only for myself here, but it's a combination of two things:
1) Setting up a router (like pfsense) with an even slightly more complicated network layout (and adding VPN tunneling definitely complicates things) is about as much fun as rolling around naked in a pile of crushed glass and rock salt. Unless you're a network engineer with at least a decade of experience, it involves a lot of arcane settings which affect things in subtle and often non-intuitive ways, so your only bet is to find a detailed guide and follow it like the Bible. Even then things usually don't work perfectly, and you end up having to tweak things without knowing exactly what you're doing. This meme captures the experience quite well: My code works, I have no idea why
2) Updating pfsense comes with a small, but definitely non-0 risk of things going pear-shaped, and you having to go through all the joy of setting it up again.
Let a very practical anecdote illustrate the above: When I updated from pfsense 2.4.5 to 2.5.0 a few years ago, something went to sh*t and my Internet no longer worked. Before updating I had taken a config backup, but restoring that backup on top of the new version did not restore functionality. Since the settings were exactly the same as before the update, I had absolutely no idea what to change to make it work again. The only solution was to downgrade to 2.4.5, which also turned out to be an unholy pain in the arse because:
a) My Internet wasn't working, so I had to drag a laptop down to the ISP router and plug it in directly to it, then search for everything I needed with it uncomfortably propped up in a place in my house not designed to house any computer equipment.
b) Pfsense does seemengly everything it can to hide away old versions, because they don't want people installing them, so just finding the right image to install took hours.
c) I then had to drag the pfsense box to the only computer in the house that still has a COM port, and hook the thing up to it. This was also a pain because the machine is now a mutimedia machine, and only hooked up to a projector. The keyboard is also in an extremly unergonomic position, because you're meant to watch movies on the thing, not hack stuff. Then I had to fight with getting the COM port connection to work, only to figure out that the cable I was using was apparently the wrong kind, so I had to get another, which finally allowed me to downgrade pfsense, import the old settings and have everything working again.
This whole clusterf*** took about 10 - 12 hours of work spread out over two days - all the time with no Internet connection other than the crappy laptop one, and an annoyed wife nagging about when she can go on Facebook again, and why we can't have "normal Internet like everybody else". So when faced with the choice whether to update or not... I hope you realize that experiences like the above have just a tiny bit of impact on the cost/risk/value -evaluation people do whenever they're faced with a choice of any kind...