When was the last time you picked up a land line phone and there was no dial tone? BT are no doubt proud of this but it's not going to make them any headlines, it's much more entertaining and newsworthy to complain about our 3rd world broadband speeds.
The SQL Server product guys are in the same invidious position; We have had over four years with nothing on a our major vulnerabilities report and that's just not going to be a big story on the Register, Fark or Slashdot, so there's no hyperlinks for me to put in.
But it would be niaive to suggest this will continue forever, and there's is a ton of new security stuff in SQL Server 2008. This will ensure we give all our audience something to look forward to; legitimate users can more easily protect their data and terrorists and criminals can stretch their minds coming up with new ways to get it. However from my limited knowledge of security I think they will increasingly rely on the old methods like posing as cleaners and couriers, or rummaging through the bins.