In reply to Peter Cralen.

A security update means there's something wrong with the current code the user already paid once for. As a plugin developer, you want the code you sell to not cause or allow a security risk. Once you realize that it does, you need to fix it.

You then need to get the corrected code to your customers free of charge, not use it as an opportunity to hit them up for another $39.

Security fixes are not the same thing as adding new features.