If your system goes down to update a kernel then you have a major issue already. This is like manually renewing https certs. When the task is done often enough you just automate it in a painless way.

There is more to the real world than running webshit behind VM clusters.

Real businesses still run legacy file/print services, license daemons, proprietary applications. Some still run on bare metal.

You need outage windows. You can't just YOLO it and update prod during the day, it's unbelieveably irresponsible.