Well that's another question altogether; however, I imagine it would be good to keep these things up to date. It can be difficult to determine how infection can spread. How can I be 100% certain that some internet enabled machine won't create an issue on the intranet? If I have unpatched machines on the intranet I still consider them as vulnerable.