Exploiting a hole does not a malware make...
I've always found it interesting to note that users of a particular OS (no names, there are a variety) often claim along the lines of "Well, a user had to install it, that doesn't count." User interaction doesn't have anything to do with it. A virus is code that self replicates. A Trojan does something other than what it says on the tin. That's all folks. They don't have to exploit vulnrabilities, they don't have to run without user intervention. By the description I've seen of this botnet, these are Trojans by definition.
Yes, users were fooled into running them, but then Love Letter, Anna Kornikova and a host of other Windows viruses relied on social engineering too, and they are *never* dismissed in such a way.
While computers still need users, there will be malware, regardless of the OS. As the average skill level of Mac (or Linux, for that matter) falls, so viruses and other malware will rise