One could, but in the old days when vulnerabilities happened, they didn't hit everyone at once. And if it hit your system, the vendor's first response would be

One could, but in the old days when vulnerabilities happened, they didn't hit everyone at once. And if it hit your system, the vendor's first response would be "are you on the latest update? that's been fixed." (Unless the latest update IS the problem. In that case, being lazy was a good defense.)