Nobody can apply all patches all the time, so sooner or later your system will be exposed for a considerable amount of time due to a bug in one of the components. That means that the real problem is how to structure the system so that it will not be so dependent of constant updating and to put an intruder in a difficult position even if he manage to exploit one of the holes that were not patched on a particular server. And keeping with the list of holes and attacks on several different flavors of Unix is a really unimpressive job to have. Here I would like to note that although security though obscurity is a bad idea, but it can work for short periods of time or as a layer in general security architecture. Just do not rely on such obscurity layers as a complete defense.
Honey pots are an important tool to make intruder to feel vulnerable and uncomfortable.
For example scans should be detected but some typical vulnerable services that are mentioned in recent exploits can probably be better made to appear as enabled, with a decoy running on a particular port. Honey pots are a necessary layer so can help to lure intruder into wrong path. If the intruder is unsure about there a particular hole is real or not and needs to guess, he is in much more difficult position and if he guess wrong the game can be over for him pretty soon. If he manage to break into computer but each change that he made is unsustainable his level of anxiety will probably be much higher. For example all this stupid tricks with rootkit will no longer work as intended.