I also sometimes (but often enough, including a time this week) hear people discuss to not install updates because of this and that.

but then if I think about it, I have trained myself too to this:
- I avoid updates to my smart tv, because I know with facts that they'll enshittify it, including patching in admin access (was not obtained by a no-interaction attack), flooding it with ads and even more tracking, and even more preinstalled apps and their own tracking. this applies to any "smart" appliences
- I am cautious with android updates, because they sometimes break things with no way back, not even a real way to do backups. besides that, major version updates always reset some settings including to not connect automatically to any random ISP's cellular network. versions starting with 8 also introduced many new arbitrary limitations out of the user's control that cannot be reverted
- I've seen many apps on the play store get enshittified, but sometimes f-droid apps to make changes that I would wish they rather didn't do
- windows updates breaking expected and unexpected things just as well
- linux is fragile regarding updates, though at times an immediate reboot solves it (when the issue is caused by incompatibility between the the on-disk and in-memory versions of the programs and program libraries)

First: IANAL, EU law is complicated. This is my understanding as of now:

TL;DR: The EU Cyber Resilience Act (CRA) aims to enhance cybersecurity standards for products with digital elements. It introduces mandatory requirements for manufacturers and retailers to ensure cybersecurity throughout a product's lifecycle. The CRA excludes open-source software developers unless their software is used commercially as part of a "product with digital elements".

would lemmy be regulated by CRA?

Lemmy, as an open-source project, would likely not be directly regulated by the CRA. The Act specifically excludes open-source developers from its scope unless their software is used commercially.

Whaz about lemmy instances?

Lemmy instances might be regulated by the CRA if they are operated commercially as part of a "product with digital Elements". (Is there a pay for access instance or hosting as a service for lemmy? I am not aware of one.) However, since most instances are run non-commercially or for personal use, they would likely fall outside the CRA's scope.

Is there a difference if there is a fee or a recurrent donations?

Yes:

• A fee is typically a mandatory payment for a service or product, e.g. a feature locked behind a paywall.
• A recurring donation is a voluntary, regular contribution to support an organization or cause, often without receiving goods or services in return.

The key distinction lies in the obligation attached to the payment. Fees come with an expectation of receiving something in return, while donations are given freely without such expectations.