I'm running Ubuntu 14.0.4 LTS on Oracle VirtualBox. The host system is Windows 10 with Bitdefender Antivirus.
Should I still install security updates for the guest OS?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
As you said, you're virtual machine is connecting to the internet. If you're using an outdated package with security vulnerabilities, your guest OS can get compromised. (How depends on the security vulnerability and the usage of the virtual machine.)
If an attacker has access to your virtual machine, he can try to break out of the virtual machine to get access on the host system, even if the host system is fully patched. An attacker with code execution on an system in your environment is always bad, even if it's an unimportant part of your environment.
If he is on the virtual machine, he has very likely access to your local network and can attack all systems that are accessible from your system.
Another possible way could be a shared directory of the host system which is accessible from the virtual machine.
Even if the other two things are not possible and he could try an attack like the row hammer exploit to break out to the host system.