In my experience zero-day threats will often still find a way through to infect a system if a user is not careful to avoid clicking on banner ads or zip files attached to spam emails etc.
Even with corporate firewalls, patch management and up-to-date antivirus installed- a lot of zero-day malware cuts through all of that like a hot knife through butter. Typically the most at risk are less computer-literate users who are too click-happy.
Nevertheless, patch management does reduce the attack surface to some extent and, as far as legal ramifications are concerned: taking steps to reduce the attack surface will help to protect your career and even you personally from legal liability if you happen to live in Europe.
As far as practical benefits are concerned- I don't actually think you will see a noticeable difference in terms of reduced virus infections if you use patch management. The biggest factors are your users and their browsing habits combined with up-to-date antivirus with (hopefully) a relatively good detection rate.
At a corporate environment I worked at which spent $10K a year on Numara patch management, virus infections on their network of 200 computers were not uncommon (we had 10-20 serious malware infections a year).
At another location which I have been supporting in my free time for 5 years now (just 25 workstations), they have not had a single virus for 3+ years. All I have done was set Windows update to install updates daily automatically, and installed Adblock Plus in all web browsers (IE allows the script to be used in lieu of the add-on). By preventing almost all banner ads (and other ads such as Youtube ads) I have been able to drastically reduce the attack surface used by a lot of today's malware, as well as improve the users' browsing experience. If you can take banner ads out of the equation, you don't give malware that relies on that as a vector to infect systems a fighting chance.
It seems to me as though there is too much focus on patch management (something which, on its own, can rarely be relied upon to stop malware anyway) and systems admins forget there are other highly effective ways to reduce the attack surface which don't cost a dime to implement.
It's all well and good doing something that reduces your chances of being sued, but you also need to remember that it should actually work as well.