That does matter in the real world, since people routinely fail to update, or are unwilling to update because they cannot afford the minute or two of downtime r

That does matter in the real world, since people routinely fail to update, or are unwilling to update because they cannot afford the minute or two of downtime required to reboot their servers. I know one guy who works with Solaris systems from the mid-90s that cannot be upgraded to anything more recent for various (non-technical) reasons. If security did not have a human element, these problems would have been solved long ago.