Once a month actually, and only if the patches were applicable. It really is not as bad in the MS world as you think. They made great strides in both stability and security over the past 8-9 years in the server OS area.

And, I say this as someone who has literally nothing to do with them on a daily basis anymore.

Keep it running no, keep it secure yes. That is true of any production system, regardless of vendor, or should be.

Your system/business setups simply reflect this, either through clustering or planned outages.

Not sure why I'm providing a rational opinion to a snarky jab at Mircosoft, but imo, they have made fantastic progress on the security front over the past decade.