That was feasible in a world where every computer was air-gapped because there was no such thing as the Internet. Now every app needs to stay up to date for security reasons, even if it doesn't directly use the internet itself.
[0] updates have been known to make software more vulnerable too you know.
Average app developer is clearly not trustable for keepimg a whole system secure (Zoom for a recent example). We have to go back to air gapping but do it on app and even internal component level instead of whole machine. Sandboxing and containers is the only way forward.
For example, cvedetails.com, some random website I found from Googling, lists 13 vulnerabilities for Photoshop and 31 for Libreoffice in the last few years.
Some of the very "best" vulnerabilities of all time have been attacks taking advantage of scripting features in Office.