Microsoft cannot keep its own security in order, so what hope for its add-ons customers?