A few weeks ago Canonical started offering livepatching for kernel updates without needing to reboot the server ( http://insights.ubuntu.com/2016/10/20/live-kernel-patching-from-canonical-now-available-for-ubuntu/ ).
Assume the following scenario: You have a webserver running on Ubuntu 16.04 with livepatch and unattended-upgrades enabled. Will it be possible to let it run for like a year without an server admin logging in and still be secure against known/patched exploits? Will also all other packages be running up to date (like openssl) or will you need to manually restart certain services to have them up to date?