Most serious security incidents don't start with a sophisticated, novel attack — they start with a known vulnerability that was never patched. Vendors publish fixes constantly; the gap between a patch being available and it being applied is where attackers operate.
For a firm running a mix of operating systems, business applications, and firmware across dozens of devices, keeping on top of this manually isn't realistic. Patch management as a managed service means updates are tested, scheduled, and applied consistently, without relying on someone remembering to click 'update' on a Friday afternoon.
It's also one of the eight ACSC Essential 8 strategies for good reason: patching applications and patching operating systems are both explicitly called out, because the data on breached organisations keeps telling the same story.