That is surprising. I have been working with Exchange since 5.0 came out. It is a house of cards and way to complicated for what it needs to be; especially for small installations. I have had many times where just applying a CU completely hoses the installation and I had to revert to a backup snapshot. Lots of times the database just won't mount on startup, so you need to run edbutil to "fix" it -- even if it was already in a clean state.
The only thing that gets exposed to the Internet on the exchange servers is the Active Sync virtual directory. I am guessing that is what saved me from being compromised -- or it could have been because I disabled all external access as soon as I saw the vulnerability. I may need to start tucking the active sync service behind a vpn as well.
Exchange requires a ton of care and feeding to keep running.
Compared to imap servers like Dovecot which are basically install and forget.