So if you run as a standard (non-admin) user, don't expose network services, don't insert random USB devices, and never run untrusted executables or installers, can a random person really get remote access to it?

I mean, even if you patch constantly, you are only safe from yesterday exploits — not from the next 0-day, and those keep coming super-often. It seems smarter to focus on hardening the system itself rather than relying on Microsoft to patch things fast enough and hoping you are safe in the gap between discovery and fix.