don't recommend that they turn off windows updates.
...unless you also recommend they use a different browser (e.g. FireFox with NoScript) and don't use the default settings. IMHO the amount of bugs that remain remotely exploitable with such a configuration (or even just IE with most of the extra stuff turned off) is reduced to be essentially none --- and if one does show up, like the WMF exploit (remember that?) you'll probably be able to install a patch just for it. IE has a Trusted Sites functionality, so you can whitelist the sites that really need that stuff if you must use it, with other random sites on the Internet being allowed much less exploitable functionality.
That said, I hope someone figures out the security-relevant portion of the update and how to patch out the other crap. But then again, with what Windows is these days, the binaries are probably signed and there will be tons of other hoops to jump through to get that to work...
People with your point of view should also consider the ramifications when you (implicitly or otherwise) condone Microsoft's behavior in threads like this.
You're definitely not wrong about any of that, unfortunately. This, on the other hand...
Nobody is condoning Microsoft's behaviour by saying you should apply the security fixes.
.... I'm not buying. The fact is that Windows Update is no longer any more trustworthy than SourceForge or any other infamous source of unsolicited bundled adware. Another, related fact is that I can't be bothered to do the necessary research to tell what is a genuine security fix versus yet another "mistake" that results in Windows 10 ads (if not the OS itself) appearing on my PC the next morning.
For some reason I don't understand, Nadella is getting away with doing things with Windows that would have gotten Gates or Ballmer crucified. Every knowledgeable user who doesn't condemn them vociferously for attempting to use an important security update service to force-feed a major OS upgrade is part of this particular problem.
For literally decades, the best practice has been, "Never upgrade an existing Windows installation. Always do a clean install." There were many very good reasons for this advice to be given to nontechnical users. Now, all of a sudden, this advice is apparently obsolete because... because it's inconvenient for Microsoft's marketing efforts?!
Sorry, no. Not buying it. Microsoft is no longer allowed to exploit my machine at will, under the guise of security or any other motivation. Believe me, if I could afford to ditch them entirely without cutting my own throat, I would. That part is my responsibility.
Too bad. This is what happens when the OS vendor becomes the threat. Trust is important, and the Windows Update team has betrayed mine.
(And spare me the tiresome "B...b...but they didn't do anything you didn't agree to in the EULA!" routine.)