Sorry to clarify: updates come as security or as feature updates. If I've already got a standard operating environment (SOE) with all the features I/staff need to do work, I don't need new features.

I then have to watch cves with my cve trackers to know when software updates are needed and all devices with those software get updated and the SOE is updated.

I can go on a rant about how bad the Linux has recently made my life as someone's policy is that any Linux bug might be a security vulnerability and therefore I now have infinite noise in my cve feed, which in turn is making decisions on how to mitigate security issues hard, but that is beyond this discussion.

So in short I'm only talking about when you update, updating only security fixes, not the software and features. Live patching security vulnerabilities is pretty much free low effort, low impact, and in my personal opinion, absolutely critical. But software features patching can be disruptive, leaves little to be gained, and really only should be driven for a request to need that feature at which point it would also include an update to the SOE.