Remember that time Microsoft let FTDI brick a bunch of knockoffs through the first party update mechanism? Remember when they locked up a bunch of embedded devices with Windows 7 support nags? Remember when they dropped Candy Crush in your start menu, when they decided local accounts now had to be cloud linked, and when they enabled Cortana by default and made it increasingly difficult to opt-out? When they decided to take 30 minutes of your morning without asking (hope you weren't planning on using the computer for anything important)?
When it comes to high-reliability embedded OSes, Microsoft is a case study in inept paternalism. Updates regularly cause problems. Between updates and malware spreading behind a NAT, I'm not at all convinced updates are the lesser of two evils. Ideally, these applications wouldn't run windows, but since they often do, IMO the best approach is to isolate them to the greatest degree possible which includes blocking auto-update (note: not turning it off, blocking it, along with everything else you can get away with).