I think the bigger issue would be keeping these machines disconnected from the internet.
No need for patches if it's an isolated system running DOS.