You don't actually need to keep web servers serving static content patched. Simply close all other ports, run a minimal web server, and it's a tiny attack surface. Some of these have made it 20+ years with zero maintenance.