Hi, I work for a VoIP provider, and I thought I'd clear up a few points: If desktop PCs have access to the PSTN via VoIP, it's entirely possible for a worm (or intruder) to use the PSTN as that VoIP user. (That could be used for a telemarketing worm or a DDoS on somebody's phone pool, I guess) This is regardless of which vulnerability the worm uses. This is made worse because some VoIP software (well, at-least one SIP based VoIP package) disables authentication by default when adding a user, and makes you jump through hoops to enable it. Yet this is mostly mitigated because almost all VoIP infrastructure is on a separate network (generally controlled by vlans and some sort of VPN technology), which can't be accessed by desktop PCs. I beleive this is pretty-much standard with Cisco equipment. So, assuming the router and switching hardware is secure and properly configured, an Internet worm can't get to your VoIP network (or even DoS it). That's not much comfort for those accessing a Internet->PSTN VoIP provider (rather than just an IP Centrix or IP PBX VoIP network), but the risk there is no greater than online shopping/banking. (Assuming you're using a secured VoIP protocol - and you're probably NOT)
