Right, you would mostly just want to deliver via your private network those updates related to user input. Vulnerabilities in file sharing, TLS, WEP, none of that will matter to an ATM. Oh, and perhaps an update to handle the year 2038 if you have a Unix backend. :)