> it allows you to not update immediately to patch a vulnerability, because the site is not the one publicly accessed?

Exactly. You can never update a vulnerable plugin if you don't want to.