Another thing worth noting is that the previous ESR will continue to get security patches for the next two months.
You did say this here:
But this made me want to clarify/emphasize the point:
Patch first is a legitimate option not only right now, but also for a little while longer.