It's obvious that one's main computer should always be have all the latest security patches and most people don't blink an eye when Microsoft Update installs non-security updates.

In the land of virtual machines, I've run into 2 problems with automatic updates:

1. The virtual machines are only run when needed.
2. Only Windows virtual machines seem to patch themselves.

To elaborate on #1, I generally make a virtual machine with a purpose in mind. For example, when I needed an old copy of Internet Explorer to reproduce a bug in RSS Bandit, I had a Virtual PC named RSS Bandit. The machine only stayed running for a few minutes at a time. Consequently, there is no downtime for the machine to download updates at 3 AM.

To elaborate on #2, I've noticed that if I haven't run a Windows virtual machine in a while, then the moment I log in, the computer frantically downloads updates and within seconds, if I click the Start button, there is a little orange shield next to the "Shutdown" button. However, I ran a freshly created Ubuntu VM for several hours today with hundreds of updates pending and it seemed to never download any of them or install any of them.

Is there any reason to be concerned about running VMs with dozens of security holes? If I should be concerned, then is there any way to get Ubuntu to download and install updates rather than just advertising a long list of updates to download next century?

I've already tried telling Ubuntu to automatically download and install updates.