I agree with your comment, except that "difficult" doesn't necessarily imply "insanely complex".

Counter-example: we once timed a release of a very minor protection update to when the main attacker typically took a holiday. We got 6 weeks out of something trivial, buying more time to work on the major release to greet him when he returned.