I have been scanning our BES domain every day since the DST fiasco for devices that do not have the patch and applying the DST sw config. I still see a few devices each day that need the patch, 8700's and Pearls mostly. I try to get these guys right away since each day someone is unpatched is a day they can schedule appts in Nov which will be wrong even after the patch is applied.
BESX 4.1.7 on Exchange 2003: 65 Devices
BESX 5.0.3 on Exchange 2003: 2007 Devices