The malware argument is a bit weak

It’s much more than just a bit weak, unless you are somehow continuously monitoring it, so yeah, in most end-user scenarios, it would hardly make a difference to keep it on, even if there were no updates.