"So digg was supposed to jump on this problem and not worry about anything else apparently."

Quite frankly, yes they should. If you have an XSS hole in your web application your other user-facing security measures are worthless. If you're a social application of any sort it's even worse; you're just asking to be hit by a worm.

XSS is a Big Deal. XSS holes also really easy to find, so if a security researcher spots one it's not unlikely that a Bad Guy will find them as well.