"Microsoft will keep the runtime patched automatically"
It would be really nice if they could get it right instead of merely posting fixes for their cock-ups if you choose to sign up for them. Same for all vendors really.
No civil engineering business would survive if they had to keep sending in workmen to fix faulty electrics, plumbing, flooring, roofing etc. for the entire life of an office complex.
It's a myth that it's intrinsically impossible to create bug free software. it just needs a different approach to development (an engineering approach). The product would be more expensive to create and therefore also at "point of sale", but its entire life cycle cost to the user would be much lower and it would be vastly safer to use.
"Cyber security" primarily consists of protecting against abuse of typically rather elementary software bugs that shouldn't have been there in the first place.