This is usually due to a programmer error, but these are often overlooked when many individual programmers work on a single piece of code.  More novice hackers read the latest security reports from Microsoft and simply attack unpatched computers before the computers have a chance to install the updates. 