That's not a popular opinion among the subset of users who refuse to apply patches, but it's the correct one from the perspective of security and public policy.

There are plenty of ways around it: maintain your own patching infrastructure and you can do whatever you want. Use Linux and you can do whatever you want. But it's an absolutely correct decision to push patches onto the unwashed masses even if it upsets them.

We would be better off as a society if vaccinations were mandatory too, but we also have some vocal idiots there too.

And does that include all the non-security patches that change things around in ways maybe I don't want?

Or immediately installing security patches even if they're broken and compromise normal functioning of the system?

I don't see even a moral/ethical argument for mandating those kinds of updates.

Now, is anybody actually going to enforce that? No, of course not. But on the principle of the thing, you are being negligent, and justifying it to yourself on the basis that you're too smart to get a virus. The anti-vaxxer parallel is extremely relevant here, if everybody thinks like that then we have a problem.

Speaking in generals, it's absolutely a correct decision to have automatic/mandatory patching, whichever way you want to look at it. As for specific patches: sure, on a case-by-case basis there may be bad patches that need to be rolled back. You can do that on Windows, and again, you always retain the option to simply not connect your PC to the internet and it makes both of us happy - I don't have to deal with another zombie box on the internet and you don't have to deal with a patch you don't like.

At the end of the day you're just going to have to trust Microsoft to put out good patches. But if you don't trust them, why are you running their operating system? Do you have similar concerns about upstreams in the Linux community? You know patches can break things there too, right?

I don't see any evidence that giving someone who knows what they're doing the ability to control which updates they deploy and when will cause them to become part of a botnet. Are you suggesting that Windows 10 Enterprise should be similarly constrained for the same reason?

And even if systems do become part of a botnet, the correct solution to that problem is to cut off the offending systems at ISP level anyway, not to rely on their own local security in any particular respect.

But on the principle of the thing, you are being negligent

Objecting to a system that requires automated deployment of arbitrary updates, including updates that may upload arbitrary data, is not only not negligent, it may be positively required for regulatory compliance depending on your circumstances.

The anti-vaxxer parallel is extremely relevant here, if everybody thinks like that then we have a problem.

No it isn't, and this naive and superficial analogy really needs to die.

At the end of the day you're just going to have to trust Microsoft to put out good patches.

Microsoft have proved, beyond any reasonable doubt, that such trust is unjustified. Try again.

But if you don't trust them, why are you running their operating system?

Because the Microsoft of a few years ago that produced Windows 7 is a very different Microsoft to today's that produced Windows 10.

Do you have similar concerns about upstreams in the Linux community? You know patches can break things there too, right?

And yet in many years of running many systems for multiple organisations, the total downtime I have experienced due to Debian unattended security updates is 0, and the number of reports I have ever read of others suffering a bad update through that channel is also 0.

Its not like the "Enterprise" version of Win10 is much more expensive. It gets way more expensive if you want to run a Windows Domain server, but that starts to leave the realm of SOHO users.