We have made enormous progress over the past five years by forcing the vendors to deliver automated patching. Now the bad guys are saying: 'You did that, now we're going after the applications.' Now we have to start all over again.
If an early infectee had an e-mail list with reporters at all the major news services, that would start the cascade. News organizations do not have radical e-mail attachment limits (like a rule banning all picture attachments) because they get legitimate pictures.