And not so major publishers, including hundreds, if not thousands in the top 10,000 sites. So it isn't just the Washington Post, et al. This is why I intervene on generalized advice to enable auto-updates on WordPress. I have seen it cause publishers a ton of money, and have lost a number of weekends when called in to perform damage limitation.

'Make sure you keep everything updated!' has a ton of caveats and pitfalls, that's just the reality.