In reply to Jeff Chandler.

Some options for reasons the sites didn't update:

(1) Developer handed the site over to a client, but with no one hired to maintain it. Many (most?) site owners don't understand the importance of having someone maintain their site for them.
(2) Site owner never logged into their admin panel and ignored all emails about it (if they received any at all).
(3) The site is dead, or almost dead. Lots of sites are just sitting their stagnant and unused. Getting hacked is a bit of non-issue for those sites.
(4) The owner figured it will never happen to them and are too scared to update.
(5) For "security" purposes, they turned the WordPress update system off.

What disturbs me the most in this whole debacle is how theme developers just randomly shove code like that into their themes without checking out it's quality first.