anyone else think this kind of thing should be the responsibility of the vendor?

isn't this kinda like solving the problem of pollution by issuing filter masks, instead of fixing the factory?

Cisco security initiative / 4 major firms working to head off Net attacks