It's actually very difficult to stay on 1607. KB4023814 helpfully(?) installs the Update Assistant on systems that are at 'end of service' and runs it regularly (and at every boot) to nag you into...