I have finally just said screw all this nonsense and did a $80 mostly permanent fix. Since I have a separate PC in my observatory and control that with Radmin via a dedicated Ethernet cable, I simply bought a second router and second NIC card, set up a separate local subnet and did not connect that router to the internet.
Since the patch was never applied to that PC now it never will be and since that PC can no longer connect to the the internet, it is close to risk free.
MS can’t update what it can’t get to. The only time I will update it in future is if something I need stops working.