What's your db2 maintenance policy? How often do you require to upgrade db2 (ie. update FP / PUT level)? Assuming you're running a supported version of db2 and there is no specific problem that requires you to upgrade.
Depends on whether your db2 servers are accessible from the internet , and/or how trusted are the connections and their origin and how valuable is the data. When fixpacks contain security-related fixes for which IBM issued advisories, and the db2 server is accessible from the internet, fixpacks get applied quite promptly.