I kind of get where Matt is coming from but the most worrying part of his statement is "...best estimate based on hypotheticals is in the tens of thousands."

So the mitigation strategy is: the first 50,000 sites or so to get hit are basically collateral damage and we'll stop the bleeding there. How is that acceptable? There should be zero sites at risk. I get that tens of thousands is a trivial number when dealing with hundreds of millions but these are real people and businesses, not just numbers.

How is this suppose to be comforting to anyone?