What's riskier? Systems that are never patched with still plenty of potential surface attack area, or systems that have a way to obtain fixes, including fixes

What's riskier? Systems that are never patched with still plenty of potential surface attack area, or systems that have a way to obtain fixes, including fixes to the patching system? If a system has an options for untrusted I/O (radios, network, unmonitored physical access), I would take the later over the former every time. Granted not all companies are created equal in how they handle security, but that doesn't change in either scenario. The same team developing a fix are also typically working on the original implementation, so it's unlikely that the system code/design quality would be drastically different.