We've been told that you should always install Windows Security Updates, but what **exactly** would happen if you don't? Can modern versions of Windows (7 and later) be infected simply by connected to the internet? (using default "Public" network profile, which if I understand correctly means no open ports by default)

Let's say I have an old machine or a virtual machine that I don't want or can't install Windows Update due to various reasons, **if I make sure to only run program that I know and trust**, what are the risks of not installing any Windows Update at all?