I have several instances running windows server 2012 on AWS. The servers simply share drives for network access, and thus have no Public IP, and are not in a subnet that uses a NAT, aka no internet Access. This has been the case for about 2 years. 

There has recently been some concern over the fact that these servers have not downloaded and installed windows updates in over 2 years, and there could be vulnerabilities these servers do not have patched. 

The good news is, even if they are compromised somehow they cannot send data outside our network.

Is it worth (from a security pov) adding a NAT to the subnet just to allow these servers to get Updates?