Re: But did they know what older version were vulnerable or not?
I suspect the problem was, that although they could send an notice to their customer's last registered addresses, and probably fax it to them as well, if the customer doesn't respond you're left in the dark.
Maybe they never got the letter/fax. Maybe they received it but it was ignored, or went to the wrong people. Maybe it was read but not understood. Maybe they actually did the upgrade, maybe they didn't.
Without ringing up each customer (assuming you still have a working contact number, email wasn't very universal in those days), you had no way of knowing if they'd acted upon the warning notice.
The only solution would be to sit by the phone on the 1st (and 2nd etc.) and wait for the panicked phone call, as an oblivious customer found out their widget processing software wasn't 2k compliant.