That’s a good point — even in the more limited sense of security today, the null hypothesis to be compared against is a regularly updated system.

I wonder if there are any viruses/exploits which are known (so that antivirus software can detect it) but unpatched/unpatchable so regular (security) updates are not good enough.