I agree with gore on this one.............well mostly. This is the bit that caught my attention:

all held out for the first day of the contest (remotely exploitable vulnerabilities), and so the rules were relaxed on the second day to also include any default installed client-side applications. This led to a quick compromise of Safari, and therefore of the MacBook Air laptop. Vista and Linux remained unscathed.
I think that it is reasonable to include default installations if you are looking at the average user vulnerability angle; but user chosen third party software is a totally different issue.

Actually the whole exercise strikes me as some sort of farce. The way I see it they had to move the goalposts twice and even then none of the OSes was actually compromised?