This article breaks down the attack vectors, and concludes that updates and patching are vital, but challenging.

https://net-security.org/malware_news.php?id=1863

It's particularily useful when combined with this article, that basically suggests applying the 80/20 rule to patching:

https://www.net-security.org/article.php?id=1630