I’m not sure the number of patches actually provides any definive information on the current state from a purely logical argument. Zero patches, one, two, or m

I’m not sure the number of patches actually provides any definive information on the current state from a purely logical argument. Zero patches, one, two, or more. That there are patches merely tells you that they tried to respond to an identified threat. It doesn’t tell you the threat was properly mitigated in any case. I think we can say it is strictly better to have more than zero patches in the case where a vulnerability is public. Exactly one patch to me doesn’t guarantee anything about the quality. Multiple patches at least implies persistent effort and dedication to securing the fix. Maybe at some point the number of patches implies incompetence but I’m not sure I’d draw that line at “2”?