His first proposal, that WordPress installs should update themselves, makes sense. His second proposal, that WordPress should show users a click-through warnin

His first proposal, that WordPress installs should update themselves, makes sense. His second proposal, that WordPress should show users a click-through warning when installing themes and plugins, doesn't make sense. The experience from e.g. SSL errors in web browsers, is that most people will just click through and ignore the warning. Instead of making it difficult to install themes+plugins, make it difficult to write insecure themes+plugins.