Vendors regularly release updates that fix security vulnerabilities. Once a flaw becomes public, attackers are often quick to exploit it — so delaying updates is risky.
Updates aren't only about Windows: browsers, office apps, servers, routers, firewalls and camera recorders (firmware) all need them. Patch management means the process is organised: you know what runs where, and updates are tested and tracked.
Example
Updates are installed centrally on every office computer outside working hours — without disrupting staff.