Update:

Patching has always been security theater for systems where security actually matters (national security), because it's assumed nation states already know vulnerabilities often years before there's a public disclosure or patch. These patches have always been to deal with nuisance actors impacting non-critical users. Besides, the user getting tricked is always the biggest risk, and patching does nothing at all for that.

If you care about security, don't get on the internet. The device you're using right now is probably already trivial compromised by unpatched vulnerabilities, if not known only by a state actor than a spyware company. Pretending this isn't the case is worse than discontinuing vanity security theater.

This is like everyone freaking out because they're shutting down the TSA. The idea that patches are important and effective is more dangerous than not patching.

The problem boiled down to the Chinese government buying out and shutting down any competitors anywhere in the world, plus Congress requiring the DoD to go with the lowest cost, which was always China. We knew what the problem was, we made the problem clear, no one did anything about it.

Maybe this administration blowing up the government is good, actually.