I've thankfully never seen a Windows Server with Flash, Reader, iTunes or VirtualBox installed, sounds like a security nightmare waiting to happen regardless updates.
I also see lots of insecure and outdated applications running on Linux servers, especially Wordpress, Drupal, myphpadmin, cPanel etc. Heartbleed and Shellshock themselves are still not patched in a good percentage of servers.