If you're on an computer there is always going to be a single point of failure with a window of venerability. Any piece of software or combination thereof will possibly leave a RCOE veunerability, which means you always have a single point of veunerability. I think what you mean is, is the unauthorized access isolated enough such that by the time an attacker finds the next thing to attack you've noticed the odd network behavior, eg defense in depth? If so, yes. But theres a difference between frantic patches and a well controlled, tested and easy to deploy set of software which makes pushing updates much less "frantic" and much more controlled. No matter what your defense in depth is you're always going to get an "oh fuck we are totally uncovered" moment, this is where the agility helps out. Your other option in this case is "the emergency shut-down for the oasis", well or the equifax option of sticking your head in the sand and running the servers open for months. I assume we're all responsible adults here though so that last one is off the table, it all comes down to risk assesment. ef seems to have miscalculated on that one.

We need to differentiate then between "patch for this one specific thing" and "upgrade to the next version" which are often conflated. The former could literally be a one-line change to correct an off-by-one error say. The latter will have to go through the full regression and release process. Often it's a grey area.

Companies like Red Hat, Suse and Ubuntu provide security backporting for exactly this reason. It's one of the major reasons that folk subscribe to them.

Unless you are part of that "tiny minority", you have no business handling information that can substantially negatively impact people's lives.

Isn't it interesting that one needs a license to drive an automobile and yet companies that handle this type of information get to do so without demonstrating the required level of competence.