Microsoft pushes out updates for OSs that it supports. Windows Server Update Services (WSUS) is a tool used to control when and what Windows updates are sent to client computers (running Windows 10/8.1).
In a corporate environment with multiple workstations, centralized control of patches are easier to manage. Having the ability to update across the domain consistently is a valuable tool to ensure the network is protected from any vulnerability without reliance on end users.
A testing environment should be used to test updates before releasing to the endpoints. Verification would ensure no issues from the updates or patches conflict with production applications.
If a patch or update causes issues with an application or process, the update may need to be removed. This is the reason testing before approving patches is vital to ensure no downtime or issues in a production environment.