I'd speculate the amount of people who have experienced malware that an update would have protected them from is orders of magnitudes smaller than the amount of people who have reliably experienced things worse after update or the update is the malware.