Yes.. Windows XP had an unending list of vulnerabilities, software patch policies were often horrible, hardware with outdated software was everywhere. Back then if you would call yourself a hacker or a hack group it would mean you had multiple 0day exploits under your sleeve for operating systems, browsers and web apps.

Even if you were just a lowly scriptkiddie, because of the bad update policies you could just go to an exploit website, like metasploit is now, and try out the list of old exploits on any target you were interested in. A friend of mine had 40.000 routers in some Scandinavian country because their ISP shipped them to customers with a 4 year old BSD release that had known vulnerabilities in it.