The answer is whatever works for the person running the machine.

If I choose to run Windows 7 forever and only use internet services from a VM - that's my prerogative.

> And if you turn off automatic updates, you become the biggest threat to your machine's security.

The typical user is already the biggest threat to their machine's security, regardless of whether updates are turned off or on. There's no windows update that specifically protects users from even the most common threats if the user doesn't exercise due diligence.