I like to be security-conscious and keep all my servers as fresh as possible regarding security upgrades.
I assume DO periodically upgrades the default kernels used for droplets.
1) Unless you're already doing this, always load the newest stable kernel when a droplet is rebooted
2) Make it possible to opt-in to regular notifications whenever one of the default kernels that a user has droplets running on receives a security upgrade
Then I can reboot my droplets whenever a security upgrade is available.