Simple. A new vulnerability came out. The number of IIS 4...

Simple. A new vulnerability came out. The number of IIS 4 servers out there is a lot less than the number of IIS 5 servers. So when the IIS 5 vulnerability was announced, it made sense for the author to adapt his worm for that. People assumed it was a new exploit and it was not.