This post overlooks a couple of things.
Firstly, the reports of sites being hacked is not restricted to just that one exploit. In the past few weeks users have reported various exploits, from the rather common iframe hack to injections of code into the footers of WordPress 2.8.4 sites.

Secondly, there really are good reasons for some people to not upgrade. Those reasons include clients who don't want their sites worked on every few weeks, to clients who cannot use later versions of WordPress. Accessibility issues in WP 2.7+ mean some people just can't use later versions. Other sites use custom plugins that cost them a lot of time and money to develop.

Look at the release cycle:

June 11 - 2.8 released
July 9 - 2.8.1 fixes security issues
July 20 - 2.8.2 fixes an XSS vulnerability
Aug 3 - 2.8.3 security release
Aug 12 - 2.8.4 security release

This is just too fast for any site that is running custom code that has to be tested and may need to be updated. WordPress doesn't release information on which few lines need changing. They don't release patch files of only the necessary security changes. With WordPress, its a full upgrade or nothing (or countless hours running diffs through uncommented code to try to find the security patches). It doesn't take much to post the lines for users to change. WordPress also includes changed/new functionality with most updates, making it even harder for anyone who just wants to apply a security fix.

The frequency of releases indicates a branch that has not yet stabilised. When its a continual "patch the patch" going on users cannot be blamed for waiting until their plugins are updated & reports of bugs have settled. Every release of WordPress says its more secure, every time multiple blogs are hacked users are told to upgrade - then that release is hacked. It happens. The sad thing about this latest round of attacks is that WordPress developers have started a blame game. The only ones to blame here are the hackers.