Ye Olde "Cache Invalidation" problems really

Instead of updating the cache of dependencies you have immediately, the suggestion is to use the cooldown to wait....

As you point out, this means that you have a stale cache member has a critical fix applied.

Next week's solution - have a dependency management tool that alerts you when critical fixes are created upstream for dependencies you have

Followed by - now the zero day authors are publishing their stuff as critical fixes...

Hilarity ensues