I can echo this. On a security assessment I found an organisation was a long way behind in Windows Updates. I eventually tracked this to the AppReadiness service being disabled, which someone thought was a cool debloat option. The end result is that machines just claim to be up to date despite not being.