The complexity is mind blowing. And yet, does it need to be? Recently I started looking at how Windows Update works. It self-updates first with a reasonably complex web services API, then it has this ridiculious way of checking what is installed by looking at undocumented registry keys and even loads its own registry component hive.
It then works out via web services what needs to be updated, and uses deltas to download file chunks.
It downloads and installs the new updates into the winsxs folder, then updates hardlinks from this folder into the c:\windows\system32 directory, but does not remove the old package.
Then it installs the updates, which can be done with a cab file, mum file, msi file or some other mechanism.
To do all if this it uses WSUS, Component Based Servicing (CBS), Component Servicing Interface (CSI), Windows Side by Side (winsxs), NTFS link features, Windows Installer and probably much more besides.
And yet it is unbelievably fragile. I can't tell you how many times I've found broken packages. Microsoft have turned on CBS logging on all systems and recently I've found that hard drives have run out of space because it has taken up gigabytes of space (this is because Microsoft archives log files in CAB files, but these have 2GB limits and if the log file goes over 2 GB it can't handle this), gigabytes of dusk space is taken up with useless old updates that until very recently you couldn't remove.... the datastore.edb file is massive and can corrupt, security patches had issues because there have been so many of them and Microsoft had to make a new CAB file format, and Windows 7 and later has the most insane package dependency generating algorithm that I kid you not but it spends hours just generating it. Some of this stuff still hasn't been fixed.
Then I look at a Debian based system. I've literally never had an issue I couldn't work out how to solve in 10 minutes. It just works, and in an incredibly fast time - and I virtually never have to reboot!