Write the functionality you need in your own plugin(s). Those can be submitted to the official plugin repo and maintained by you, or you can write one off plugins (what I usually do) that are client specific and never hit a public code base. You also need to think about the plugin. Does it only have 500 active users and hasn't been updated in two years? Probably should stay away, regardless of the quality of the plugin right now. Is it contact form 7 or something like that? Go ahead. These are factors in a decision to use third party software in any project, WordPress or no.
Usually I offer some sort of maintenance contract to clients. Sometimes they want to do that, sometimes they just want a fire and forget site. Depending on that and other things, I may set WordPress to fully auto update core and everything else or I may set it to never auto update, or anything in between.
The key is to communicate to your clients/boss what the end product they're getting is and how maintenance will be handled (or won't be) in the future. You need to be upfront that WordPress is evolving software that needs to updated, and to explain that this is in fact a good thing, as it means bugs, security vulnerabilities, etc will addressed in a timely manner. Communicate all the relevant details to your clients/boss and let them make the decision, don't make it for them.