While many prefer the Microsoft-bashing model -- in the case of worm outbreaks -- it is actually the end user who is equally to blame for the spread of a worm. The time difference between patch availability and the release of the worm in some cases was more then six months. The Zotob worm patch is the only one (in the table above) that was released just five days before the infection went public. In the case of worms like Blaster, Sasser and Conficker, users had almost a month to fix/update their systems.

If I play the devil's advocate here and give the benefit of the doubt to a user/system administrator/security professional, I would probably do one or all of the following,

Blame Microsoft for making an 'insecure' operating system.
While there is a common consensus that Microsoft has to take security more seriously compared to some other operating systems like OpenBSD (while OpenBSD is a very good security effort, it is not going to house the common desktop anytime soon), they are definitely not the culprit in this case. Microsoft has released patches for all of these bugs that were exploited before a worm outbreak.

Blame the techie/security agency for having found the vulnerability.
Some people believe in security through obscurity. They would argue that if the techie/security agency had not found the bug the vulnerability would not be so widely and publicly known and as a result such a worm would not have existed.
There are many individual researchers who have the technical capabilities and motivations to find security bugs. While they might not be inclined to write viruses and worms; the example of an advanced worm like Conficker clearly shows that virus writers have a certain amount of technical expertise. The use of the MD6 algorithm (a cryptographic hash function) in Conficker is a clear indication of worm evolution. If a researcher does not find a vulnerability, it is certain that another techie with a less honourable motive will. Not disclosing vulnerabilities will not reduce the number of outbreaks.

Blame the guy who wrote the malicious code (worm).
Yes, writing a worm is unethical, illegal and punishable. But there will always be someone who will try to take advantage of the system -- 'cybercriminals' will not cease to exist. That would be a Utopian view of the Internet.

The bottom line is that those who were affected by the worms listed above are clearly to blame for not updating their computers with the latest security patch. Individuals as well IT security professionals need to take the onus to ensure that their operating system and security software is routinely updated (automatically or manually). Instead of reacting to an infection, organizations need to be proactive enough to keep the computers on their network updated, thereby reducing the chances of falling prey to infections like Conficker. Prevention is better than cure.