The whole problem boils down to a choice :security or availability. If you prefer to have systems 100% up (no downtime for patches and fixing potential issues

The whole problem boils down to a choice :security or availability. If you prefer to have systems 100% up (no downtime for patches and fixing potential issues after the patch) then it is fine. The actual risk (described beyond "having security") has to be accepted by the owner of the data / service and the problem is over. I have yet to see a CFO who will accept in written that his systems are prone to hacking, theft, manipulation. Until the CISO does not force the company to sign off such risks, he or she will be the one who fucked up.