Yes, this is a new normal. No amount of what we historically would have thought of as "normal" preparation can prepare you for being instantly 0-dayed across one or sometimes multiple simultaneous fronts. Merely mentioning something tangentially related to a 0-day is generally enough for any random joe to "clean room" recreate the 0-day and be off to the races.

The historic embargo system is likely not sustainable and we need a shift in both approach and security posture (ie fully trustless architectures by default). Not only that, but because of the insanely amplified frequency and risk of the 0-days, you generally have to throw the baby out with the bathwater and leave yourself completely vulnerable to supply chain attacks. Because not short-circuiting taking upstream updates leaves you open to attack.

Theres shades of the old normal in this stuff, but absolutely this is the dial being turned up to 11 and I dont know if theres any right answers for small teams out there.