Sometimes it is. Depends on the vendor, of course, but I've seen them take many hours/days after a security fix is released.