Oh we(organizations I have worked for) have been hit several times (not IIS, but once it was several wordpress sites we used, once it was outlook, once we never figured out - probably inside job, ... ). But that was 3, 4 times in 20 years.
Updates its 3,4 times per year. Like I said order of magnitude difference
Until you get hit by this....
https://www.giac.org/paper/gcih/201/microsoft-iis-superfluou...
It was the first widespread IIS vulnerability that almost hit me. The tl;dr version: All you had to do was encode a shell command in the url bar if the site was running IIS and it would execute it on the server.