While you may sort of have a point for low-severity issues (if you patch every one ASAP, you are constantly restarting; should be tested in a group in stage and

While you may sort of have a point for low-severity issues (if you patch every one ASAP, you are constantly restarting; should be tested in a group in stage and released to prod on a regular timeline), this was a 10.0 severity CVE and it is _definitely_ the kind of issue that you tolerate some downtime for. Check out the CVE, this could be exploited by anyone with a basic knowledge of cURL in 60 seconds or less. The vulnerability was just a matter of sending an arbitrary command in an HTTP header.