Most disable Windows Updates for that reason, afaik? You can manually patch security updates without getting automatic updates, I think.

I don't really care about Windows Updates for my use case since it's just a VM and I know how to prevent most virus vectors anyway, but yes; there are major trade-offs to "debloating" Windows.

In the longer term, I want to try getting all my must-have apps for work running in browser apps or compatibility layers so I can just stay in Linux.