Well, how do you think the Sasser, or Blaster worm propogated? the time it takes for the exploit to be discovered by vbulletin, and the time to deploy a patch leaves a huge gap in the system.Especially with private exploits, it can be months, or sometimes a year before it gets leaked.