So, why I say it is a loosing battle is because when I look for a weakness its not a known CVE and its not known to be exploited.

Many of these companies can keep up to date assuming their vendors report correctly, The exploits that are not publicly documented are rarely fixed.