Security teams have measured patch rates for so long that somewhere along the way, the metric became the strategy.