What about the people hit by the breach in the following 48 hours after the vulnerability is announced? Especially when attackers know they have a short window

What about the people hit by the breach in the following 48 hours after the vulnerability is announced? Especially when attackers know they have a short window of opportunity before patch Tuesday hits. Microsoft do issue out of band updates but they are very rare and for very serious issues. It isn't like Microsoft was stalling for time, they didn't ask for months, they asked for days to fir into their scheduled releases. It's also worth pointing out the enterprises time things on the patch Tuesday cycle. An earlier release causes all sorts of implementation problems, especially if only a day or two in advance. In all likelihood you wouldn't see many machines actually updated in that period, but cause significant extra grief.