Interesting, not unexpected.

The exact numbers are probably not accurate. It's in the interests of people running such
tests to find problems to overstate, just as it's in the interests of corporations and
networking companies to understate. The distribution of unpatched/insecure machines will also
be non-uniform and non-random, making an overall statistic hard to interpret. The truth is
rarely out there, in any objective sense, but a subjective feel for the scale of the problem
is probably good enough and an order of magnitude error won't change that nearly as much as
it'll change the number itself.