Won't that theoretically allow malicious actors to study the patch and exploit the now 1-day vulnerability?

Not that I think it's realistic to develop an exploit and gain real value in three days, but theoretically, if all parties had taken more than three days to distribute and apply the patches?