Oh we(organizations I have worked for) have been hit several times (not IIS, but once it was several wordpress sites we used, once it was outlook, once we never figured out - probably inside job, ... ). But that was 3, 4 times in 20 years.

Updates its 3,4 times per year. Like I said order of magnitude difference