In reply to Jeff Chandler.

I think I can shed some light on why people did not upgrade.
The sites that did not upgrade can be split into two categories, the sites that are being managed by the developer and the sites that have been handed to the client, putting them in full control.

When the client is handed the site, they generally dont know what to do, so they usually do nothing. If they do happen to login to their website (which is rare) they will likely not update the plugins and themes. Worse still, themeforest only emails the developer and so the end client is left completely unaware as most themes do not notify of available updates. However the revolution slider does, but the update wont work as the theme needs to be updated as a whole.

Then you have the developers (who dont care) because I know that other developers like you and I who follow news will update as soon as an issue is publicized and an update pushed through. But most developers won't update. I recently had a long talk with a developer who has not updated cpanel or any other items within their server since the day it was setup, some 4+ years ago. Their explanation was that when they update, things break and that needs to be addressed which costs money and reduces profit. By not updating the server, they can save money and just roll the customers site back to the last uninfected backup, knowing perfectly well that that will likely contain the vulnerability that resulted in the infection to begin with.

These are hard lessons to learn, but I do like it as it shows the low quality developers from the high quality developers in my humble opinion.