I wouldn't say Microsoft is pretty good at updates. I once installed a patch for a security flaw in DNS in our Windows DNS server and got reamed by my boss for bringing our site down. I have found the policy of installing all updates when first setting up a Windows server and then never touching it again to work quite well. We also keep all non-HTTP access to a VPN.

Alternatively, don't use Windows. App Engine is my preferred platform for new projects and the security on that is most likely top notch and constantly upgraded.