Re: "Oh, FFS (not again)".
The blame is firmly at the feet of Microsoft for this ...
At the risk of being rude, what good is railing against Microsoft going to do you, other than making you feel better for a few minutes?
Perhaps you should be looking at mitigation strategies?
Several levels:
1. Immediate: Well, it's probably a good idea to consider following Microsoft's advice and quit printing through your domain controller. And if you can't live without printing? If you have only a few users who actually need to print, maybe you can connect them directly to the printer(s)? Perhaps you can set up a print server on an spare PC -- assuming you can get Microsoft's rather bloated software to run on it. If you don't print much, maybe you can sneakernet, or email essential print files to a directly connected computer. Perhaps a Unix print server? CUPS seems pretty reliable nowadays (Is that even technically possible?)
2. Nearer term: If you believe that Microsoft is incapable of or uninterested in providing adequate support to your operation, maybe it's time to think about voting with your feet. But what's the alternative? Apple? Unix? For many(most) operations that's either daunting and probably expensive solution. Or it's flatly impossible. I don't have an answer. I don't think anyone does. But it won't do any harm to think about it And it might help.
3. Long Term: In this case I expect that for most operations your internet connection is much more of a threat than your employees. I think that's true of most of the problems we hear about. What are you going to do if it turns out in the long run that this Internet thingee is truly unsecurable? That's unacceptable? Sure. But it seems far from impossible. After all, Security looks to be a really HARD problem. Not accepting reality has generally worked out poorly for most folks in the past. Reality is that you'll either live with it somehow or unplug your connections to external networks -- at least to the extent that's possible. We'll surely know better about this in a few years. Again, thinking about it probably won't do any harm.
I'm sure that I'll be downvoted for this opinion. So what? But if you truly think I'm mistaken, how about articulating your objections in a comment for a change?