What's riskier? Systems that are never patched with still plenty of potential surface attack area, or systems that are uncontrollably patched with still plenty

What's riskier? Systems that are never patched with still plenty of potential surface attack area, or systems that are uncontrollably patched with still plenty of potential remote and MITM attack area? I can't decide, but in both cases, removing remote access removes the problem. My car and toaster wouldn't be much more useful with Internet.