That depends on what is required of the SSL implementation. A self-signed cert which the client cannot verify still provides some protection. It is MITM-able, but casual snooping is prevented. If this is the specification, then this implementation is not broken.
Put it this way. Forget the specifics of SSL for a moment. If unencrypted data is acceptable, then in what way is having the option of weak-but-slightly-better encryption suddenly "broken"?
This analysis is flawed because it assumes that strong security was required by all who use SSL at all. Many installations use a self-signed SSL cert by default. These default configurations often remain when security is not required and therefore not configured further. I suspect that this skews the figures far enough to make this sort of analysis meaningless.