How much work is required to maintain WordPress?
If you are not maintaining the server itself, very little. Even actual server maintenance doesn’t usually take that much time though.
That is, how often are there security updates and new versions that
you will probably want?
Basically, you want every release. I would not advise skipping releases or trying to apply only the releases that look important. Sometimes the releases come faster than I’d like. I’d much prefer a different release model but no use worrying about what isn’t likely to change. I’d guess you’d need to update twice or three times a year. Releases seem to be coming a bit faster than they used to but I haven’t actually looked at the dates.
How difficult are updates to perform?
Remarkably easy. I tend not to use the automatic updater and go with the manual update because I can run the release locally before uploading, then upload the tested code as a whole. Still, not difficult and I have never really had a serious issue with an update, though you do see people report update problems so they happen.