Everything you said is very general. The article in question talks about "Linux servers" (or that's what I read). Speaking of those, could you explain specifically, what is the point of a wholesale update, as opposed to what is described? What I mean is running specific set of services (which most often built from source anyway) and keeping those services up to date.
What you get in return is both stability and security, since you don't wait for vendor to release a patch and actually understand what the vulnerability is.
With wholesale patching, in fact, you can never be sure whether your system is secure with respect to all published vulnerabilities.
Another interesting detail is, that with services running built from sources often you end up with vulnerabilities not applicable to your configuration.
Oftentimes, you can just tweak the config instead of changing code (and potentially breaking running things).
Software updates is just a cop out for people that are too lazy to pay attention to security.
What you get in return is both stability and security, since you don't wait for vendor to release a patch and actually understand what the vulnerability is.
With wholesale patching, in fact, you can never be sure whether your system is secure with respect to all published vulnerabilities.
Another interesting detail is, that with services running built from sources often you end up with vulnerabilities not applicable to your configuration.
Oftentimes, you can just tweak the config instead of changing code (and potentially breaking running things).
Software updates is just a cop out for people that are too lazy to pay attention to security.