[gambiting]

I don't know why you are getting downvoted - ATMs are never connected to the Internet directly, they connect to the bank either using a built in modem(yes, the dial-up variety) or their own VPN systems. So it's extremely unlikely, if not just impossible for them to be downloading their own software updates, unless they are published by the bank for the machines to download.

[hueving]

I didn't downvote, but I'm guessing it's because the majority of vulnerabilities are irrelevant if the thing is not connected to the Internet.