Would organisations with very conservative attitudes to upgrade paths or a requirement to run an older OS version have suddenly been patching nightly?
Would the exploits used have been identified and patched prior to their malicious deployment?
Would organisations with a vested interest in stockpiling exploits have elected to immediately notify projects' maintainers?
The answer to these swings wildly between 'maybe' and 'probably not', so the eventual endpoint is likely largely the same. It's a compound issue brought about by a chain of decisions made by disparate organisations, and using it as a stick to beat Microsoft or proprietary vendors in general with is missing a very important point -
Security is the responsibility of everybody involved, from vendors and the government, all the way down through to the people innocently opening infected attachments.
