VBScript is basically dynamically typed VB6. It's not a nice language - it has all the worst parts of VB6, and then adds its own. Take a look at some of Eric Lippert's old blog posts from the days when he was working on VBScript:

https://blogs.msdn.microsoft.com/ericlippert/tag/vbscript/

To give one example, that is somewhat relevant here because it describes one of the biggest misfeatures of the language - default properties - that is used in the exploit:

https://blogs.msdn.microsoft.com/ericlippert/2005/08/30/vbsc...