Even the security updates are often dubious. Software that could be entirely local (with a system provided filesystem backup/sync for data) adds "cloud" functionality so that it can lock you into the SaaS subscription model, and now it's got the network as an attack surface. Even there though, it generally just talks to the vendor's servers, and if you control the vendor's servers, you probably have more direct attack routes than some http client bug.

"Security" patches are something only checklist-driven corporate IT (i.e. people who can't consider use-case) ought to care about. For individuals, they're mostly a cudgel to justify abusive practices and should be ignored.