Windows 2003 SP1 locks the door on install
About a year ago an article was published that an freshly installed Windows XP machine connected to the internet was infected by a virus or worm way within the hour (I think it was about 20 minutes on average). Which makes it almost impossible to install a machine and download all patches before infection strikes without precautions like disconnecting the network and installing a (closed down) firewall before reconnecting it.
Windows 2003 SP1 solves this issue by blocking all inbound traffic untill all relevant Windows Update patches are installed. That's the right way to go.