A look at why this is such a tricky vulnerability and why the industry response has been good, but not great.