I agree with that, but these are two parts of a whole. Even software with reduced attack surface needs the ability to react quickly to discovered issues.