Thanks, this makes sense. I was thinking perhaps a bit too narrowly from the perspective of someone producing the patch, rather than about that long tail of users on the vulnerable version.