Of course I can and will keep up with every vulnerability for every service that is running and facing the Internet.

I do not accept the risk of waiting for some vendor to release a patch. If there's a hole, read the report, determine whether your config/build is vulnerable, rebuild.

Why would want to patch something you are not running or use?