> but devs can only work so fast, which creates a window of opportunity which damages both them and their users.

Sadly, time and time again, what in practice ends up happening is the window of opportunity is wasted by the devs being instructed to work on new features rather than fix critical security bugs the company thinks are not widely known.

Apple’s response to four zero days being only the most recent high profile example of that.