This wouldn't be a problem if everyone applied the patches immediately, but they don't. This is a bit like the concept of "herd immunity" in immunology: an immunization programme only becomes truly effective when above a certain percentage of people have had the jab - sometimes that percentage is as high as 90%. You can't force people to have immunizations. In the same way, Microsoft can't force people to apply the patches. Of course, it can be argued that applying patches on a monthly basis is a lot less pleasaninjection every once in a while!

What advice would you give to security researchers?


Persevere - it often takes time, luck and a lot of dead ends to find something interesting. Think about the wider effects of your research, and consider how you can resolve the apparently conflicting aims of getting headlines and of acting responsibly: if you do things in the right way, there is no real conflict.