It is important to remember that there are scanners running over all IP addresses on the internet and checking for all the new vulnerabilities. So if you are not updating your services and one of your services has a vulnerability that already has an open source module to scan for it, then you are going to get scanned and you are going to get exploited. So it's not just about having basic protection, it's also about being really up to date, which not everyone is doing properly.
Temporarily there would be some cows that would need milking (cows that their calfs were already slaughtered) but that wouldn't last more than 10ish months which in the show it hasn't been that long.
It is important to remember that there are scanners running over all IP addresses on the internet and checking for all the new vulnerabilities. So if you are not updating your services and one of your services has a vulnerability that already has an open source module to scan for it, then you are going to get scanned and you are going to get exploited. So it's not just about having basic protection, it's also about being really up to date, which not everyone is doing properly.