This is a legacy BSD store that macOS inherited. Apple has their own security stack that already responded to the incident within 2 hours in most cases, which means all first-party and most third-party apps were already covered. They seemingly just didn't have a mechanism to update the legacy BSD store out-of-band, which is more of an oversight than "poor work".
They didn't inherit it. They chose it. If you choose to build on something, you should support it, and support it well.
Apple created and designed the update system for their operating system from scratch. The fact it doesn't include the ability to update a security-critical file quickly is entirely their fault.
Most (if not all) of the popular BSDs managed to ship the update ages ago. I would expect a trillion dollar company like Apple to have better and more thoughtful engineering than random volunteer projects.