From the security standpoint and the patching standpoint, you are 100% straight on accurate.
Unfortunately, Apple Microsoft and Google all sell ads. They are also all working on training AI with your data.
The upside is, as far as ad companies go, they're not just handing over the data that "bleachedbluejeans23@apple.com likes red squirrels to be vendors" They sell client code where the client pulls the ads directly from apple's platform.
They're all collecting dossiers on you. They have all identified you and their systems with whatever emails, payment cards, what have you that you use on their systems. And they have a database with all of your intimate desires and wishes and wants and how much money you make.
When Google started doing this, they threw up the don't be evil banner. You can't just give all this information to a company and then trust them not to use it forever.