So microsoft used to let you know when updates - even scary security ones - were available but never make you take action. They've gotten way more aggressive and now you have to have specific versions or a set of DevOps skills to prevent them from regularly applying and restarting your system. Their clients are mostly like yours: non technical users of very powerful systems; why don't you force upgrade after a certain period, even if it breaks apps in order to secure them? It has to be because that's bad for your company's goals, i.e. security is important but below growth and usage.