And that is the worst possible and most damaging vectors are never exploited - usually due to programmer inability. I used to see it again and again with DOS virii, and then macro virii and now IIS worms. It's almost as though the truly brightest, competent and knowledgable to write a virus/worm are always on the white hat side. Wierd.
Wade.