It was true. This was mostly because Windows XP had several open ports by default, and before SP2 (released in 2004) did not have a firewall. So when a vulnerable service in the default install was found behind a default-open port it would spread and replicate extremely quickly: https://en.wikipedia.org/wiki/Blaster_(computer_worm)
It was true (well perhaps more like 10 minutes). You had to connect your machine straight to the internet (ie. through a dialup modem), not via a router.
Also, some ISP's blocked ports which protected you somewhat.
It was certainly quick enough that there was no way to get the updates installed before the machine would bluescreen (many of these exploiters didn't care much for the stability of your machine...)
Well running unpatched stuff is no longer like that. I bet you could use a 2013 iDevice for a whole year and not get exploited once.
Exploits are mostly against the rich and famous now, and not so much against regular joe.