Sometimes very dangerous, as an example a company may pay for security updates for windows XP, but you won’t get these updates. Say someone takes a look at what changed, finds a buffer overflow or other easily exploited bug, embeds that in a program, and pays to have it bundled with some freeware. One of these exploits could infect you just from visiting a webpage.

Security updates are annoying but they’re the one kind of update Microsoft is actually justified in pushing