Assuming the vulnerability level is 1 to 1 (which I very much doubt) it still makes sense to avoid a mono-culture. It allows us to work around any single point of failure and improves the cost/reward structure for exploits.