High-capability defenders should not passively consume vendor patches. Mature security teams understand the flaw, validate exposure, apply mitigations, test fixes, and sometimes patch locally under strict engineering control.