Microsoft releases countless hotfixes for bugs for Windows that aren't released through Windows Update. They maintain separate branches, one is just security fixes that you get in Windows Updates and one is cumulative bug fixes that also includes security fixes (QFE) but you have to visit the particular KB article to download (in some cases request for free). Windows Update is smart, if you download the bug fix + security fix (QFE) it knows to install a newer QFE version of the file.
Service packs incorporate bugs fixes AND security fixes, and maybe native support for more hardware.
A lot of people don't know they need a particular bugfix for their hardware combo. All they know is Windows crashes, "Micro$oft sux" and Steve Jobs is God and shat gold.