No and no? Unless I'm _really_ misreading the article or your comment I think you're misinterpreting what's happening here. IIS a webserver that gets packaged

No and no? Unless I'm _really_ misreading the article or your comment I think you're misinterpreting what's happening here. IIS a webserver that gets packaged with most versions of Windows. Once attackers gain access to a system through some exploit or another they're leveraging IIS to create a persistent and alternative entry point into the system (a "backdoor"). SessionManager is the name of one piece of malware that does this but it's emblematic of a recent trend of using IIS once you gain access to a system. There's nothing to be patched because there's nothing built into IIS and it's not deliberate by Microsoft in the way that "Increase in Android Malware" wouldn't be deliberate by Google.