It is increasingly easy to create a verified fix for a software bug. What takes the time is verification and validation (V&V) testing and system integration testing: proving that the patched device still behaves correctly in every configuration it ships in, and still works with everything it connects to. Today, there is no approach, technology, or regulatory environment that resolves this bottleneck.
A recall of more than one million pacemakers took eight months to produce a software fix. The fix introduced unintended behaviors of its own, and the corrected correction arrived fifteen months in, on an issue associated with four deaths and 2,557 serious injuries.