That depends on whether the fix that Peggy deploys for one client also fixes the same problem for the other 399.

In other words: It depends.

There's no general answer, because deciding where to draw the abstraction barrier between you and your vendors is an unsolved, difficult, and evolving problem.