Does the average joe face any risk by NOT applying this update?

Yes, significant risk. Not from Pegasus, since that is obviously going to be targeted against journalists and so on, but these exploits can be used by anyone to do anything, especially now that it is public knowledge.

The fact that you are talking about exploits that do not require user intervention, and involve pdf and web rendering, which are some of the most common tasks you can do on a phone, is a big deal.