Most laws and regulations require a site to provide "reasonable" and "adequate" protection. While those are loaded legal terms it is generally interpreted in su

Most laws and regulations require a site to provide "reasonable" and "adequate" protection. While those are loaded legal terms it is generally interpreted in such a way that a site should be proactive enough to be updated against known and patched vulnerabilities. It looks like TIM is reporting on those -- I didn't see any zero-day stuff -- so, to answer your question, I think TIM has a very defensible position if faced with a suit.