This is why defense-in-depth is so important. Very few companies can test and rollout a patch in a few days, and that's not even accounting for regulatory concerns that may add additional time.
It’s partially the security industry’s fault for promoting ineffective and expensive methods as the go-to.