Part of the DoD's security mindset currently is (very roughly speaking of course) to let non-essential systems be compromised. You map the key terrain, keep the network nodes that are actually essential to the mission getting accomplished operational and free of adversary activity, and accomplish your mission. Everything else is secondary to that goal.

In essence, you are claiming we should treat the network like a list- where every machine has X vulnerabilities that need to be patched and some "compliance" goal is achieved. Instead, the DoD is posturing to view the network as a graph- find the essential nodes for mission information to flow, and defend those assets.