Unless you are in the IT industry or at least an enthusiast, this is a rational approach.
On the other hand: Your USB ports stopped working? You should've been updating the bios. You got breached via the browser or email app? Should've been updating them.
If I were a marketer, which clearly I am not, I would think it would be bad marketing to have your computer constantly be telling you "HEY, you need to drop what you're doing to apply this fix for me at random, because if you don't someone is going to install ransomware. Oh and by the way, we're going to install Candy Crush Saga with this, because fuck you."
Maybe the person not updating isn't rational, but if every update is fucking candy crush I couldn't blame them for saying "maybe microsoft is worse than the hackers"
And I live in a house where the only other person has only ever user Windows, and hates change. Like even desktop icons shouldn't relocate unless she does it herself.
She fights every application update unless there's a clear reason, then there better not be any more differences than the ones indicated.