The window between patch release and a working PoC is the dangerous part: once a fix lands, the diff itself tells attackers where to look, so the patch has to deploy faster than the diff can be reverse-engineered. Version pinning and staged rollouts turn into a race problem, not just a maintenance habit.