For that matter, why didn't they test this on at least one machine before releasing it? Is it not standard to have a release process that includes testing?
Not to mention incremental roll outs, which would have caught this problem before it hit every win xp machine.
A guess: presumably whatever checksum they invent will have a severe risk that hackers will reverse engineer it and then devote their vast botnets to manufacturing virii that give the same checksum thus handing them even more control.
There are secure hash algorithms and message authentication codes that are extremely secure.