It was true. This was mostly because Windows XP had several open ports by default, and before SP2 (released in 2004) did not have a firewall. So when a vulnerable service in the default install was found behind a default-open port it would spread and replicate extremely quickly: https://en.wikipedia.org/wiki/Blaster_(computer_worm)
It was true (well perhaps more like 10 minutes). You had to connect your machine straight to the internet (ie. through a dialup modem), not via a router.
Also, some ISP's blocked ports which protected you somewhat.
It was certainly quick enough that there was no way to get the updates installed before the machine would bluescreen (many of these exploiters didn't care much for the stability of your machine...)
Was that actually true, or just an urban legend? I've heard this a lot back then, but never actually saw it happen.