No large corporation installs patches simply because they're available. Lots of patches are of no consequense whatsoever, and don't justify the risk of downtime.
I live in an SBS world and my servers are naked to the world. I install all updates, but not the first day they're out.
That depends on the vulnerability. If it's remote and relevant to what the box does, it's patched ASAP.