What is the solution implied here? Attackers - whoever they are - already have them, so perhaps it's time we close the patch gap instead.
One strategy that can help in the meantime is to make sure that we never have fixes for both renderer vulnerabilities and sandbox escapes in one patch gap at the same time. That's a new strategy we're working on right now.
The problem is also only relevant as long as security vulnerabilities still make it into release. The models are getting better and better at finding the pre-existing ones as well as newly introduced ones by commit scanning (which never make it to release then).