For plenty of users, their only exposed attack surface is the web browser and AV codecs. Updates outside of that make no security difference for them.
Until they realize that every Microsoft app sends data to mothership.
