I think the confusion here is that there are three types of advisories: Core issues, contrib issues, and PSAs. You're probably looking at yesterday's PSA saying

I think the confusion here is that there are three types of advisories: Core issues, contrib issues, and PSAs. You're probably looking at yesterday's PSA saying "watch out for an important advisory tomorrow" and wondering why there aren't more advisories. It's because they're in the other two sections. It is certainly standard for code in disabled plugins not to be accessible via Drupal. The problem in this case is that the plugin's authors wrote a separate script having nothing to do with Drupal itself, and made it web-accessible. That's pretty unusual for contributed code.