I think this kind of attack towards WP sites will become more and more. WP has evolved from a pure blogging platform to a full-blown CMS, and people are making business out of it. There are several web design companies in my area are using WP to build web sites for other companies. Some of them don't have programming background, let alone cybersecurity, and rely solely on plugins and themes to design the web site. When this kind things happened, I don't think they have enough knowledge to act upon.

Plugin and theme developers should be blamed definitely for this security attack, if they could take security more seriously, the attack could have been prevented long before. On the other hand, I am thinking maybe the WordPress development team can do something to increase the security. For example, if it knows some plugin or theme has security vulnerability, then it can disable it automatically. It sounds very intrusive, but isn't Automatic Update already doing that?