Handbags at dawn. Ignore it and move on before you both look even more silly.
Regarding WSUS. I don't find it the easiest system to install and manage. For SMBs with little in-house IT expertise it does seem like overkill. I'd like something simpler, but having nothing is perhaps too far the other way.
In terms of the listed advantages of WSUS:
Bandwidth: a decent proxy server will cache the downloads anyway, I believe, so this might not be an issue.
Reporting: a decent antivirus/security system will normally report on Windows updates and list any clients that haven't installed critical updates. And this is normally more user friendly that WSUS.
Testing: do people really test updates? How common is this. I'd never find the time. Updates are released weekly, so you'd be testing constantly. And there are loads and loads of updates. Plus, by having a testing strategy in place, you are delaying the roll-out of updates. For critical security updates, this is leaving your systems exposed to zero-day threats. Isn't the risk of having an unpatched system greater than the risk of an update breaking a system? There was an IE update recently that broke our ERP system and I was advised in advance by the ERP vendor not to install it so I configured WSUS accordingly. But this left me in a dilemma, the ERP vendor was effectively dictating that we run IE unpatched and this is not a good place to be. What should you do in this scenario? Or do you release all critical updates and just test non-critical ones?
So generally, I use WSUS and authorise all updates for client PCs without doing any testing. Nothing generally gets broken, and if it did there's normally a way of uninstalling the update or otherwise working around the problem. I'm more lax when it comes to servers. Too lax, and I need to step it up, it's a big weakness of mine.