Patch available does not mean patch deployed

The gap between a fix being released and a fix being installed is where almost all of the risk lives.

Publishing a patch also publishes the existence of the flaw, and attackers read release notes. So the moment a fix appears is the moment exploitation becomes more likely, not less, for everybody who has not installed it yet. Dashboards that count available patches measure the vendor's work. The only number that changes your exposure is how many are actually running in production.