Actually, the White House was hacked two weeks ago. [1] Not much is officially known, some think that the hackers managed to penetrate a lot of their systems (some employees leaked info before the announcement).

[1] http://www.usatoday.com/story/theoval/2014/10/29/white-house...

I presume most of the bigger Drupal sites are run by teams that care about security enough to follow security lists closely and have release management in place that would allow hotfixing within hours, if not minutes, of a critical vulnerability being announced.

Whitehouse.gov is still on Drupal 6 and not affected by this vulnerability.

The petition site is D7. But last I checked they have some pretty heavy hitters on that project. They probably knew about and patched the vulnerability before it was even publically released.