I agree in general about the damage/spread relationship with viruses but I think there's simpler explanation for Newlove - it happened right after Loveletter got all of that attention, which is while people were thinking about security. The problem is that such attention will almost always drop off after the initial scare is over. LoveLetter was called a stupidity virus because the recipient had to run it; while users stopped running things right after the LoveLetter media-fest, that vigilance started to decline the instant things died down. I'm sure that within a few months you'd be able to get a large number of people to run such a thing again.

As far as the cry-wolf and limited security resources problems go, those are very real and very dangerous. Security needs a lot more attention than it gets, particularly as it should be implemented from the beginning, not grafted in much later if someone has the time (e.g. Microsoft style). Many companies do not devote enough resources to security but I have a feeling that will change as the security community starts to remind shareholders how easily such expensive damage could have been prevented. A real threat cannot be ignored forever.

I like the OpenBSD approach of taking security very seriously, because in addition to defanging theoretical monster viruses it will also stop the very real threats like the legions of script kiddies, the smaller population of attackers who know what they're doing, industrial espionage types and even limit damage from internal threats (e.g. stupidity or disgruntled employees). Warning about uberviruses would be crying wolf at this point but the other threats are very real.