This issue definitely falls back on the client and this particular issue comes back to Patch Management practices, and also the ability to detect the zero-day exposure through good Vulnerability Management.
I have several enterprise clients here in Australia with Citrix NetScaler's that were vulnerable to the exact same issue, and fortunately all of them were able to implement the initial workaround that was issued in late December.
One of my clients didn't patch until 7 January, which was just in time for malicious actors that were starting to exploit this vulnerability actively on or around 11 January.
We're lucky in Australia that our government was tracking exposure to this issue, and they were contacting large organisations to warn them to check they had applied the patch too.
