Virtually all of the "cyber-attacks" in the past few months have been the "someone forgot to update Exchange this decade" or "someone left the default username

Virtually all of the "cyber-attacks" in the past few months have been the "someone forgot to update Exchange this decade" or "someone left the default username and password configured" and not the "newly discovered OS vulnerability results in a drive by attack" variety. That sort of raw incompetence has been addressed by the many already existing standards.