We've already got a way to patch zero days at the system level even if you use local NuGets. Fear not! This exists today, in fact.
The mechanism describes seems to imply they won't as Microsoft Update won't know the vulnerable assembly is sitting on the machine waiting for a failover.