There are two separate issues: the base system and pkgsrc.

For the base system, NetBSD 1.6.1 release is a point along the
netbsd-1-6 branch.  Just as you update along the head branch for
current, it is entirely reasonable to update long the netbsd-1-6
branch.  Security fixes are pulled up to the branch promptly.

The key question is how safe this is in terms of not breaking systems.
It has been my experience that tracking the netbsd-1-6 branch has been
low risk; builds almost always work, and the system almost always
runs.  I consider this reasonable to do on a production system,
although if it were real production, I'd set up a test box to bring up
to -stable first, check it out and then do the production system.

I'd recommend ~monthly updates, whether you need it or not.  This
makes the panic updates when you need them much easier, since a) you
don't have to go as far along the branch, so fewer surprises and b)
you are used to doing it.

With pkgsrc, there are two options.  One is to track the head of
pkgsrc, which is no different from the case of using -current.
(audit-packages, notice a problem, cvs up, make update, restart)

The other is to track the release branch for pkgsrc; this is
relatively new (first in 1.6 release), and I don't know how well the
patches/updates are pulled up to this branch.
cvs log on Makefile in pkgsrc shows the tags:

symbolic names:
        netbsd-1-6-1: 1.52.0.2
        netbsd-1-6-1-base: 1.52
        netbsd-1-6: 1.47.0.6
        netbsd-1-6-RELEASE-base: 1.47
        netbsd-1-5-PATCH003: 1.46
        netbsd-1-5-PATCH001: 1.43
        netbsd-1-5-RELEASE: 1.37

I have been following the head of pkgsrc, and aside from things like
gnome which have 15 levels of dependencies, it has been low grief.