There are mitigations for many vulnerabilities that don't involve the software being patched. For example, once you know a particular vulnerability exists, even

There are mitigations for many vulnerabilities that don't involve the software being patched. For example, once you know a particular vulnerability exists, even if it's unpatched you can monitor for attempts against it, modify firewall rules and process monitoring to improve your awareness, etc.