"argued that it would be unlikely that malware writers would tailor their code to exploit flaws in Sophos given that it controls only 10% of the enterprise market"

It seems to be a ridiculous argument to make. This would still not rule out targeted attacks.