The effects of the next Drupal security hole should be entertaining.
I would guess all that is publicly accessible is static and being served from Squid or Varnish.
Good luck taking advantage of any Drupal security hole.
Much of Pressflow's codebase was backported from Drupal 7, so its advantages will be available to all Drupal sites after the stable release of version 7 sometime early next year.
All Drupal 5 and 6 sites can use these features by substituting the Pressflow core.
Now I'm wondering how the US government will contribute back to the Drupal project.