I disagree
with "that a freshly-rebuilt system has to go online in an unpatched and undefended state" because both antimalware/antivirus and patches can be applied (and often are) before going online with a fresh install. It only makes sense to upgrade a system as much as possible before going online. I install much of my protection software from a USB stick which is in my pocket everyday except Sunday, my day off.