m$ behind security sound a bit like a joke. maybe they
should start
improving the security in their current products... or am I missing
something??
Yes, you are missing something. They don't want to improve security in
"current products", because if they build it into new products instead,
then they can make you pay for it. So instead of real fixes, they just
patch a few widely known vulnerabilities.
Of course, they wouldn't want to build too much security in all at once,
because then they couldn't make you pay for it again the next year, and
the next...