Uhm, this is SO not true. Google, for example has done white papers and research docs, written articles, blogs posts, and practically screamed from the mountain that they use a "no trust" model including a wide range of individual measures on each resource. While firewalls are not used on ALL devices, they are used on many.
Facebook also uses asset level security, including asset level firewalls; discussing this in an article about them signing a deal with Duo Security, and Ann arbor, MI based security company.
Both of these companies have repeatedly made public statements that there is no canned answer for security, and that even individual resources are treated differently depending on case. You should not use random companies for example without knowing that your facts are correct.
Ignorance:
With regard to your "Ignorance" comment: Whereas you are correct that the real value of a currency is the exchange rate for goods and services, you don't account for the fact that the price for said goods and services is set by a value judgement or analysis based on basic public trust in the currency used to mark the price. The reason the Dollar has a true value is because I can measure and compare that value. The comment was not ignorant at all, you just didn't follow the logic through to its end. You should not be quick to call fool...
This sounds like a reason to support the idea, not a reason to prevent it. If you are correct that "everyone" releases buggy code, then maybe we need to give them an incentive to do a little more testing. Do you believe that manufacturers should be allowed to continue production of a product when they are deliberately ignoring safety recalls? Would you feel cheated if you found out that Ford had deliberately ignored a known safety issue, and sold you a car that is known to catch fire, or to repeatedly stall without reason?
Programmers love to put out an upgrade with new bells and whistles, and this is good. I have no problem with the fact that open-source AND proprietary software will have bugs that show up and require addressing. I also have no problem with software having a limited support cycle. I DO have a problem with the fact that a new revision of a product (or several new revisions in the case of some developers) will be released without ever addressing the known issues, or that vendors will refuse to address issues on a current product. This is gross negligence, and needs to be addressed.
I think that the idea of a stated legal responsibility warrants consideration. If nothing else, it gives direction to a area that is, as of yet, not being addressed at all. If we can create a standard set of responsibilities for IT professionals, then it will not only hold them responsible for failing to meet their obligation, but also define what is NOT their responsibility.
This is not a hidden cost of Windows, but a hidden cost of having ignorant admins and/or management. If you're spending $2.5 Million cleaning up a virus infection, you've done something terribly wrong along the way.
But there is an important point to be made there, as well. Microsoft advertises the large number of Windows admins available, and warns of the increased cost of using "specialist" admins for *nix environments. If they are basing their TCO studies off of these admins, then the "ignorant admin" cost as you call it IS part of the TCO which is not being considered. Microsoft put themselves in this spot when they modeled their certification into an advertising campaign for the number of admins rather than a way to certify the best technicians when they were competing against Novell 4.3. The author's point still stands.
"Can't you just gesture hypnotically and make him disappear?" "It does not work that way. RUN!" -- Hadji on metaphyics and Mandrake in "Johnny Quest"