I'm sorry this makes absolutely no sense to me. It feels like a convoluted explanation for being stubborn about auto updates and then an example of precisely why they're useful.

I would take an unaudited patched-for-known-cves over just not updating any day.