What use is a counterattack if it's immediately fixed? Then absolutely nobody can use it, not even a few experts.

You’re making a lot of assumptions about the capability to reconnect and patch/update itself, preface the fix with “keep your machine offline from here in out” and we’re back to fixing it for everyone before that point.