If you want to use it, the firmware will need to be updated, and therefore quickly no longer vulnerable once Sony patches it.

If you wait until later, the units in the shops will also have patched firmware.

It will likely get patched in following versions. Stores may be required to update the firmware before selling consoles.

On a sealed boxed console? No chance. It's literally the first thing that will pop up when a network connection is established.