Some of the machines had the recent patches for the services in question but were missing other important patches, therefore allowing the perpetrators to gain access to at least try the exploits. Other machines were just wide open. Your infrastructure is only as secure as it's weakest link. Most vendors allow retrieval of patches over the web. CERT and CIAC also have information about security patches, including links to vendor patches when applicable.
Vendors release patches for reasons other than making our lives miserable.
You need to convince them that an ounce of prevention is worth it. Apply the patches during that window. Not the most optimum, but it'll work. Poster has some good advice for integrating security. Their Intrusion Detection FAQ has a question about justifying IDS .