Whenever something like this happens I am always left wondering if it would be better to legalize and organize some sort of "locking service" which goes around the (national) IPs, finds the holes, breaks in, fixes the hole and sends a message to owner (if it is possible to determine who it is).
I think I am mostly aware of the implications, but I wonder if net effect would be positive...