As with the patches for the vulnerabilities used by the ransomware, there was no negative impact described by Microsoft.
In a utopia, system administrators would be patching systems on a near daily basis. However, in the real world, it is the complete opposite.
Some updates may have to be reviewed, such that they do not negatively impact the productivity of an enterprise. While rare, some institutions consider down time, and the potential loss of work to be very significant.
Systems may not be connected to the network, or may not be connected to a corporate server that instructs for the deployment of certain updates. Laptops are notoriously known for being behind on patches because of their portable and unconnected nature.
Furthermore, some institutions may have patch cycles, such that a patch might be public, but not deployed for a month or more.
There was no valid excuse for the impact of the ransomware, as the patch and notice was public March 17th, but the vulnerabilities were taken advantage of almost 2 months later (May 12th).
You can read the security bulletin by Microsoft here: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx