You have to, because attackers aren't using canary systems. What good is it, if someone finds a new unauthenticated RCE in Windows, and you have to wait a week

You have to, because attackers aren't using canary systems. What good is it, if someone finds a new unauthenticated RCE in Windows, and you have to wait a week to make sure your detection method works correctly? By the time the week is over, every computer in the world already has the virus. And then you have to wait another week to test your removal tool.