The Day 0 to Day 13 timeline makes the argument better than any statistic: the fix existed upstream for twelve days and the dashboard stayed green the whole time. Pairing it with Mandiant's drop in average time-to-exploit to 5 days shows why a CVE-triggered backlog ticket is already too late. Watching upstream release notes for the libraries in an API gateway seems like the cheapest first step toward getting ahead.