How do the computers running the HMIs get security patches then? Only the most critical equipment would have a budget large enough to pay someone to put window

How do the computers running the HMIs get security patches then? Only the most critical equipment would have a budget large enough to pay someone to put windows or linux updates on a USB and get all of the computers updated. I don't allow the HMI computers to access the internet, but then they remain unpatched. As an OEM I'm out of the picture once the plant is working.