Defending the patch gap against automated attackers

It seems like the consequences of this for harder to update software is going to be rough. If there’s extensive compliance/regulatory/testing cycles between a patch being announced and applied it almost guarantees you just publicised an attack vector.

I wonder will we see new less public/visible paths to updating software that can’t just be restarted whenever.