You're right, of course. Exploitable weaknesses in busybox are going to be killer - I think shellshock will turn out to be the start of something really big.

But, to clarify for others, the existing shellshock PoC doesn't work on the busybox environment I tested (v1.20.2).