#1 depends on everyone deploying in a timely manner the fixes that the blue AIs find.
The bad guys are historically much better at keeping their systems current.
We might see a return of some viruses and worms patching out others so they can keep running, but with AI.
This is survivor bias because bad guys that suck are ignored as "noise". There is a ton of very low-tech outdated vulnerability scanning going on that is not at all current.