it's up to your risk matrix.... but i don't see how any risk calculus would allow security patches to sit for this long. And pretty sure it's in violation of the actual rules when it comes to maintain these systems... fed systems have rules they need to abide by.
I've usually advised deferring major updates by a few weeks so kinks can be worked out, but critical security were rolled out ASAP (after a backup was done WITH A TESTED BACKUP/RESTORE procedure) in a gradual roll out. we didn't spends months waiting for security patches, and we grouped systems by mission criticality/exposure/etc... And i think that the backup/restore is usually the ignored bit... and why people are hesitant to run updates too quickly... at these scales, this should have been an automated task, and the more i think about it, the more i feel this was a case of some tech worker no approving the patch for deployment by accident.
Or they deployed, tested, and it broke the systems for some reason... and they couldn't take them offline/further restrict access for another reason... so they were stuck maintaining an unpatched SharePoint deployment vs rebuilding it from scratch with all the patches.
In the case of the Apollo program, it was reliable... not secure. I'm sure if you went back in time and looked at how the chips operated, how the actual programming language behaved, how the machine code was actually compiled, and how the compiler behaved... you would be able to find loads of vulnerabilities in that chain today, they didn't even think/worry about security. They didn't have to worry about someone remoting into NASA and ransoming the moon lander. They did have to worry about ensuring that the computers were reliable, consistent and accurate... as basic (compared to today) as they were.
On a side note - if you're keen on this stuff... look into the track record of patches introducing additional vulnerabilities in the same vein of what was patched, completely new types of vulnerabilities introduced, or breaking previous patches... that's a fun subject to get into.