This is a the big issue. Too many people complain about that one patching issue. Yes, we know everything is broken in some way, but that doesn't stop anyone from constructing layers of defence where even with a full compromise of one system you get very limited access internally.

That should've been a huge point of the published document, not just "we didn't patch, so it's game-over".