I'm say saying ISA is perfect by any means. I've run into its limitations on many occasions (only just NOW does it get SIP support!?). But I mostly deal with companies of 20 people or less, and they just don't have the budget for a dedicated firewall appliance with the features that ISA provides. Besides, anything in the wrong hands is going to be a problem, which is why I make sure the client stays out of it and calls me when they need something changed. It was just a good balance between price and feature set (as long as you knew where the limits were) that is going to be hard to match.