I can think of multiple situations where a vendor from SK has left things unpatched for months, and sometimes years..