I'd rather deploy a Windows update within 2 months of its release and be safe from a RCE vuln.
As a physician and researcher, this attitude from IT people is why you find physicians who don't like you.
Then it shouldn't be connected to a non-secure network / the internet in the first place.
Also... images? :^) I think you're giving too much credit to the sysadmins in these organizations (and I talk from experience, can't say more).
Such hubris.
When I worked night shift in emergency dispatch, our base network ops center pushed out an update that took our phone workstations offline. The phones that receive installation 911 calls and communiques from the command post. With no warning or notification of such an update.
Their reasoning? "We didn't think anyone would need it at 0300"