The problem is, by releasing the patch they alert attackers to the existence of the bug. I don't know this to be the case here, but for things like Windows vuln

The problem is, by releasing the patch they alert attackers to the existence of the bug. I don't know this to be the case here, but for things like Windows vulnerabilities the time between releasing the patch and it being exploited in the wild is only a few hours. For systems (like core routers) that are simultaneously too critical and too available to permit timely maintenance cycles, the only solution is to not have any bugs ever.