So that's a good point, but I feel compelled to point out that I've never seen a large organization with AFP shared user directories.

There are far more important vulnerabilities --- clientside drive-by remote code execution, for instance --- that have gone unpatched for longer than this. Do I think 3 months is a reasonable time-to-fix? No comment.