16 years without reviewing password security seems like a massive oversight. A major leak like this it's a high price to pay to learn this lesson.
To be fair to them it took till around 2008 for this to become widespread opinion but the signs were on the wall around 2004