The point of my comment was that, yes, this kind of policy would be good and might have stopped this attack.

But it wouldn't solve the whole problem, just make it a tiny bit more difficult for the attackers. Definitely worth doing, but we will need to address the culture of 'ship and forget' also or we will just have the same problem but with software exploits.