It seems that the only way to solve these "problems" is to make WordPress unhackable, which although technically possible is probably not feasable since it would require development plummeting and all efforts being directed to security which would not lead to further development of the software. I guess that's part of the reason WordPress 2.0 was kept as a stable version for so long, but that route failed as no one in the right mind would bother using 2.0 since it was so far out of date on everything BUT security issues.

So in a nutshell, I think we should just keep telling people that they can leave their site un-upgraded, but don't go whining about it if/when you get hacked.

I got hacked a while ago now. There was no point in me complaining about it as it was entirely my own fault. I simply didn't bother upgrading one of my sites and so someone eventually found it, hacked it and bingo my site was stuffed. This seems to happen to many other people, most of whom just take it on the chin like they should, but for whatever reason a bunch of people getting in a big huff and try to blame WordPress itself for their own laziness/stupidty. I see little/no point in taking notice of these people except to try to ensure that those who listen to their rants are made aware of the fact that it was not WP's fault that a site got hacked.

The fact that there are no reported cases of WordPress installations being hacked EVER bar those which the owner has not bothered to update is brilliant advertising for the softwares security.