The mass prevalence on ThemeForest of bundling plugins into themes, a practice we certainly didn't want to adopt, was one of the reasons we decided not to release our most recent theme on TF. How are you supposed to compete with products that throw caution and best practices to the wind, bundling in hundreds of dollars' worth of other products for which the customer has no real license?

These products lead buyers to believe that a $45 theme that *doesn't* bundle in a multitude of other products is over-priced or a rip-off, which is just ridiculous.

I would love to see Envato go much deeper in their response to this, ruling out this practice completely. Would it hurt their bottom line? Perhaps, but having this kind of critical security failure that exposes thousands of their customers isn't exactly going to help the bottom line either. And if theme authors start advertising *support* for plugins instead of bundling the plugins themselves in, that ultimately benefits the plugin authors (and Envato) who should see more sales as a result.