A perimeter appliance is not a long-tail asset competing for attention. It is the front door.
Nobody broke the rules. The rules have no term for the gap between a vendor knowing and a controller knowing, so two compliant clocks can sum to anything.
Seventy-four independent due-diligence processes, all compliant, none of which established whether the vendor patched its own front door.