It can depend on the use case. To some extent, once the VM is created through vCAC you would treat it the same as any other, ie: add to the standard patch regime for your environment.
Where this approach doesn't work would be things like agile development and continuous integration environments, where VMs are spun up and removed in quick succession. For these types of machine, the patching is usually done during the provisioning of the machine, so that you get the newest verison of the OS whenever you deploy a machine.
