>A one day attack? sure if the supporting org is on their toes. Most of the time it will be weeks to months. if it is patched at all.

You should look at the CVE list that's fixed every month. Surely you agree it's important to have those exploits patched, especially since baddies can reverse engineer the patches to find the original exploits?