Agreed on the first point. It's true that minimising the amount of random input will help your security. That will always be true. It was only their fault that they don't limit the access.

OTOH, they have to run public services in an accessible way. Someone could just as well find a bug in their webserver, or mail server. It's bad for PR of course, if their webserver is hacked. But not all servers are equal. (here starts the IMHO part) If you want to spend your time on making everything perfectly secure, you're a full time sysadmin, not a security researcher ;) I think that there are a lot of test, web, mail, etc. servers that people just don't treat as very valuable. Every webserver could be virtualised and the whole system could be checked in a loop by a securely signed checksum verifier which sends (every cycle) results using PKI to a vpn'ed server which sends you an sms if your index.php checksum doesn't match (and snapshot + suspend the machine along with memory, then bring a failover up via a non-lan channel). Is it worth their time though?

People can think that makes the company look bad, I don't...