But that's a fixed cost, not a variable one. They have to issue the fix, period. The poster's point was that MS does not lose money because of an OS vulnerability directly. Here, however, they do.