Yes, the default listening services were the worst as they were easily exploited; but most users are behind a NAT, and you could still disconnect from the Internet and apply the update first, or disable them. More precisely, it was common in those days for connecting to a network to be one of the last things to do, after already having set up a lot of other things before that.

The fact that some versions of Windows 11 require an Internet connection just to install and go through the initial setup seems like it could be even worse.