No, it really is a scare tactic, and people like you parrot it as if it's gospel. Meanwhile I have years of actual experience cleaning up infected machines and every one of those became infected because the user installed something. *Every* one of them. Didn't matter if they were fully updated or not, the user is by far the biggest security hole.
Now for public facing servers, yes security updates are absolutely critical, but for a typical home PC that is sitting behind a router it just isn't that important, there are numerous small obstacles to exploiting them and typically it just doesn't happen. A couple months ago after a similar debate I actually fired up an old XP laptop connected to my home wifi and let it sit there, after about a week I got bored waiting for someone to p@wn it and shut it down. It's going to take a few exploits to change my mind because so far I've never seen it happen even once to a PC not directly connected to the wide open internet.
Anyway regardless of any of this, my PC is my property and I have the absolute right to administer it any way I want. If I can't control updates and vet them individually then I'm going to completely disable updates and anyone who tries to force me to do otherwise can piss off. Few things are more irritating than Microsoft apologists.
Allow me to interject. Mr Scram is absolutely on the money. My qualifications come from almost 20 years in the IT industry, having worked for the Australian Government in Cyber/digital forensics and a Master's Degree in Cyber Security. I also run my own company which specialises in secure networks.
A router (particularly a consumer one) will do little to stop cyber attacks, crooks stealing your data or user ignorance/stupidity. Attack vectors differ and there is not one single solution which will protect you. For a home user, the bare minimum should be:
1. Regular updates to OS, applications, anti-virus and device firmware.
2. User awareness and education.
3. Not logging on as an Administrator to do everyday tasks.
4. Regular backups.
5. Use unique and strong passwords for everything.
Remember
WannaCry? That directly exploited a serious vulnerability in SMB. It was so serious that Microsoft developed an update for Windows XP and Windows Server 2003 even though they were considered end-of-life several years beforehand. Hundreds of thousands of machines were infected. This is just one example of many.
The equivalent of not updating your operating systems is like solely relying on the seatbelt in your 1992 Toyota Corolla to keep you safe in a crash.