It was true. This was mostly because Windows XP had several open ports by default, and before SP2 (released in 2004) did not have a firewall. So when a vulnerable service in the default install was found behind a default-open port it would spread and replicate extremely quickly: https://en.wikipedia.org/wiki/Blaster_(computer_worm)