Several things come to mind immediately.
What should be obvious to IT decision makers by now is that end users still are not security-conscious enough to make appropriate decisions when faced with an immediate risk. In addition, most organizations that have deployed Microsoft Outlook and Explorer with the default security settings intact should be questioning this policy. Of course, it is valid to question why Microsoft ships products with security settings set to weak defaults, but knowing this, companies should consider and set their own policies regarding appropriate use. Companies need to weigh this added convenience vs. the real risks rather than simply accepting the manufacturer's default settings when deploying desktop software. Companies also should seriously consider implementing products that filer active content, such as Finjan's SurfinGuard, to handle those currently inevitable scenarios when malicious code does arrive at the desktop.