> there are going to be critical enough systems that may be under a serious threat of breach that any wait is not worth the risk.

Disagree strongly. You are analyzing risk the wrong way. That is what I call: "Security by being on the latest patch"

Zero days occur every day and many are ongoing right now. Your antivirus vendor or OS vendor, needs hours to days, to weeks, to detected them, understand the attack, come up with a defense, test (hopefully...) the defense patch, deploy in phases (hopefully). So you are always many hours to days behind the latest threats and before getting such a protection.

The core idea here is "Critical System"

If the system is critical, it's security and robustness needs to rely on it's security architecture. Not "being on the latest patch". You will always be catching up to any threats.