The parent comment was saying that they thought the IT systems for a law firm were managed by a lawyer in their spare time, which is different from this case yo

The parent comment was saying that they thought the IT systems for a law firm were managed by a lawyer in their spare time, which is different from this case you describe. Maybe the IT folks properly and accurately described the risk, and were stopped by non-IT management. Alternatively, maybe IT didn't push as hard, describe the risk properly, or want to deal with an annoying patching process. Microsoft also deserves blame for the difficult of patching, as your link describes. Either way, the real victims are the 114,979 folks who had their information stolen. If a bank gets robbed because they didn't do basic things like locking the doors or hiring a security guard, they don't get to raise their hands and say "BuT cRiMInAlS". This is literally the same as what IT does whenever they get hit by a highly publicized exploit that's had a patch for months.