Microsoft is no different than most large corporations. They have had the same problems with macro viruses, e-mail viruses, and the like that every other corporation has battled. No matter how tight you make it, something will always slip through, that is to be expected. Three weeks means that costs will be high for Microsoft. Forensics will take weeks and millions will be spent on public relations to try to calm fears of source code tampering.
Security is a full time job.
It requires dedicated personnel. But most importantly it requires detection. Every company can be cracked or get some kind of virus, it s currently the nature of the game, reaction can only happen after a new virus or exploit is released. Detected quickly damage is minimal, undetected for long periods and the company is left guessing and playing spin control. Learn from Microsoft, get your policies and personnel in order now, make sure you have adequate coverage for detection.