Patching without testing: Risky or Rational?