> If I'm not adding new hardware or exposing services to the public why would I need to update anything?

Because you might be using a web browser and/or email client to interface with the outside world...?