For most users who are emailing, reading some web forum, social media, and maybe office that matters very little.
Even fully up to date there is always another zero day, so for individuals doing nothing of particular importance the best bet is good up to date backups of the important files and when your software tools are working well to help you get whatever it is you do done, don’t change them, and don’t update them, because odds are there will be some regression, some feature removed, a change to a subscription model, some functionality now depends on the Internet, or some level of telemetry/spying.
Software has become hostile to users. Everything is nearly malware now. Easily snap shotted and sandboxed VMs are just about the only way to maintain some level of consistency over a 5-10 year span where you are depending on the software to just keep doing what it is doing.
But, not surprisingly, "For most users who are emailing, reading some web forum, social media, and maybe office that matters very little." don't understand or know how to do rolling backups or operate a VM, so keeping their OS up to date is the best option. Denying them that, regardless of how little they use the internet, is reckless at best.
