Today, if it's vulnerable to an exploit, it's probably been exploited long before the vendor finds out about it. Patch-based security stopped working once the opposition became governments and organized crime, not script kiddies and email spammers.