The only thing the users had apparently done wrong was not updated their installation. It was because of this that I started to move clients away from Wordpress. The trouble is that a lot of non-tech clients will not touch their admin panel very often and I have found the older generation don't like the word update. It suggests to them "may break or change theme so I can't find stuff."
I find the idea that - probably - the worlds most popular website platform can frequently ship with security issues demoralising. If you look at all the people involved with Wordpress you would have thought that by now they would have squeezed the issues out of WP and learnt enough to ensure they stay squashed in the future. Maybe I expect a bit too much here.
One of the big selling points of Wordpress is that there is a plugin for anything. However.. how many of these have security issues? It is even worse as non-tech users just assume that as the plugin can be accessed from the their admin panel it must be safe.
It is for these reasons that I do not use Wordpress at all. I think it is an alright platform, not keen on the theming aspect but it is OK. However its incredible popularity makes it the target of hackers and spammers. When working with non-tech clients who may or may not update their website, Wordpress is liability more than anything else.