These basic accounts were used to obtain root access and start up password sniffers. In the past administrators left on services they weren't sure of. As attacks become more sophisticated this needs to stop if the hosts are to survive. We expect every administrator to know exactly why and what services are running. Frequently this exploit is wide-spread, being developed and sent through mailing lists consisting of thousands of people.
Every operating system provides security related patches free of charge.
In addition most systems come with an easy way to install them, either some sort of script or tool. This means installing a patch comes down to the administrator simply downloading the patch and running a program. The security of a system internally is directly proportional to the age of the patches. The longer you wait before applying a patch, the more likely it is that it will be successfully exploited. It is not uncommon to have a 3 month old vulnerability incorporated into an automated tool that thousands of hackers use.