Microsoft clearly disputes this in their own posts on the subject.
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer...
"Customers running Windows 10 were not targeted by the attack today."
What's your source?
"Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible."
If you don't have the update, you are not protected, you are vulnerable.
Laws must be passed to:
* Force the US government to report vulnerabilities to vendors
* Create a regulatory body to monitor the use of vulnerabilities in clandestine operations and ensure that mandatory reporting is upheld
I cannot see anything less working.
Get that through US and EU governments, and you'll likely have the vast majority of vulnerabilities being reported and patched.
Of course this is akin to asking the US and Russia to convert their nuclear stockpile into reactor fuel.