I work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whitelisted forbes.com.

NoScript will very often block exploit chains from occurring even if it won't necessarily always block stage 1.