Your under the illusion that enterprise security vendor's are not being proactive.
All enterprise firewalls are updated daily, sometimes multiple times a day for threat and malware protection.
What the article isn't telling you is Sophos is a mid grade British vendor that's about at the same level as a Barracuda or Fortigate firewall, not enterprise level.
The scandal isn't that a security company got hit by a zero day that took two days to fix. It's that there are US based companies using foreign products.