Sure, but do you really expect the one-person maintainer of a random Wordpress plugin to be backporting security fixes? In an ideal world I'd love to see that,

Sure, but do you really expect the one-person maintainer of a random Wordpress plugin to be backporting security fixes? In an ideal world I'd love to see that, but my guess is that that's not often going to be the case. Then the question becomes: is it more effort to backport this fix into a codebase I don't know? Or is it more effort to bring everything else up to using the new version. Either way, it's going to suck :)