That's great until you have a public zero-day exploit.

Cooldowns don't apply when you're patching a CVE; like, dependabot vulnerability scanning in GitHub has a separate cooldown from auto-updates

If it's big enough like this one you can always make an exception.