I've attempted to patch four 98SE VMs, with IE5.01, 5.01 SP2,5.5 SP2 and 6.0 SP1. The first three ended up with no outstanded critical updates or any other patches I was interested in installing. There were 404s along the way, but those files seem to have been made redundant by other patches. The IE 6.0 SP1 VM 404s on Security Update, November 2, 1999 "This update eliminates the "Virtual Machine Verifier" vulnerability..."
I've also tried with two Me VMs, with IE 5.5 SP2 and 6.0 SP1. The IE6 VM chokes on Security Update, May 19, 2000 "This update resolves the "IP Fragment Reassembly" security vulnerability" and Security Update, September 9, 1999 "Update for Security Vulnerability in Windows 98 Telnet Client" Both fail with an "Unknown Error". The IE 5.5 SP2 VM hangs without populating the updates. There's an error hidden behind the Please Wait pop up. It's a surprise as the same browser works on 98SE.