At some level, agreed that it probably helped security wise for researchers. That the fix was committed in public and then vulnerability remained for a month and well still currently for customers is where one could make a case that the open source nature did as much damage as good.
> That the fix was committed in public and then vulnerability remained for a month
That's an indication that Microsoft is bad at handling security issues. Which isn't news and has very little to do with open source.
Something very similar happened with Exchange, it led to plenty of people being compromised, and Exchange is not open source.
When you distribute patches for a vulnerability it basically makes no difference whether the source for those patches is available - people are quickly going to figure out what the vuln is. This is a patch rollout problem and nothing else.
