I think it's conceivable for a fix to exist such that
1. knowledge of its inner workings could be used to prevent it from being applied.
2. it will take weeks to reverse, by which point most systems will be upgraded.
3. once applied, the trick used to prevent it from being applied cannot be used to remove it.
trivial example: the fix creates a new file "supersecurity" only if the file doesn't exist. by creating an empty with that name, you can upgrade but dodge the fix. but once you've got the supersecurity, you can't delete that file.
I agree with your first paragraph: It is possible for there to be a "fix" where knowledge of its inner workings would expose an easy way to prevent the fix from being applied.
Of course, what I said would still apply: I am less confident that such a thing would be resistant to compromise using other methods. So, if they have this supersecurity patch to put out, after it has been installed they should be eager to tell the world how the systems are now secured.
trivial example: the fix creates a new file "supersecurity" only if the file doesn't exist. by creating an empty with that name, you can upgrade but dodge the fix. but once you've got the supersecurity, you can't delete that file.