Why not three months? Why not six? I do not get it. How is this same conversation still happening? This was public the day the patch was sent to the list or pushed to a public git server. Do you think adversaries are sitting around for a POC? Or for you to decide to get around to patching?

I can't help but physically shake my head as I write this. I can't imagine actually asking people to try to play pretend security through obscurity because folks still can be arsed to implement some sort of reasonable update strategy. I have enough experience in tiny and huge shops to say that it's a matter of prioritization and it's just a blatant form of technical debt and poor foresight.