AFAIK, it's the other way around, the MS security patches were issued after a virus had exposed a security hole. In general, it's "virus exposes security hole -> Microsoft patches said hole", not "Microsoft issues patch -> virus programmers reverse engineer it to find what holes were there so they can hit unpatched systems."
As for the "every reported bug was fixed before release" you object so much too, it tends to happen to me the next day after I turn something in. Only at that point do I start finding the problems I didn't fix. Also, you can see in the change log for 1.01 "fixed all reported bugs". Maybe you're refering to different things. You judge the comment from the state of 1.00 (which is perfectly natural and the most obvious understanding of it) while the comment was made on 1.01. Remember, 1.01 was available on release, so it's likely Paradox sees 1.01 as the state of the product then. (as a side note, it was certainly the state of the out of the box product in Spain, because of the delayed release)
As for your continued demand that "all critical bugs be fixed before release", I'd think that would be a pretty general wish. The problem is, some critical bugs aren't that easy to find. For instance, you say the game crashes a lot. Now, we have most people reporting no crashes, or only very limited amounts. So, it is quite possible that there is a problem that was not addressed because none of the testers ran into it. Sometimes, the testers fail to notice major bugs. The testers develop a familiarity with the product, and learn how to do things. The first time the untrained user lays hand on the product, an incredibly obvious problem is revealed. And it makes the testers look extremely careless. Or, problems show up in some system configurations that weren't tested. The spanish release didn't work on AMD K6 processors, for example.