I don't think will remain true. Right now, for instance, Nimda has left a reservoir of machines that have been compromised in such a way that anybody can go in and execute commands with administrative privileges. And these machines announce their IP addresses constantly via Nimda's attempts to spread to other web sites, so anybody can find them if they want to. (Most of these machines probably belong to unsophisticated cable modem users who don't even know that they're running IIS, but attacks of various sorts could be staged from this group of machines. In addition, some of the machines may actually be of greater importance -- government or corporate machines, for instance.)
Most people running IIS have installed the patch which closes the hole Nimda used, and most infected machines have been cleaned up, so the reservoir of compromised machines is much smaller than it was in October or November. But it could easily happen again in a similar fashion, and somebody could take advantage of the security breaches this time.
The Internet is such an essential part of our communications infrastructure now that one can easily imagine a massive attack on the Internet as being one prong of a military or terrorist action.
Apparently it got corrupted when I posted.