regarding A, absolutely! That tradeoff, and how to make it was the core of my paper with Crispin Cowan and Steve Beattie on 'Timing the application of security patches for optimal uptime.' One thing we didn't talk a lot about was the cost of applying patches, which we explicitly set to 0. That's wrong, and ignores the reality that there are patches that don't matter enough to apply. But it made modelling easier. :)