If a developers code brings your website at risk he should fix the issue regardless expired licenses. His code should have been secure in the first place. In most cases the fix applies to only one file that will also work on the older versions and or he can just provide the lines of code to replace. If not possible he should replace the plugin or theme update for free. Its like buying a car. When they discover a serious issue you get a callback to the garage of all the affected models. What foo plugins is doing is very bad at the expense of their customers to fill their own wallet.

Btw this never applied to the revslider as the updates are free. The issue was fixed in feb 2014 and only existed for a week after it was discovered. Whereas sucuri brought it in august. The theme developers with the integrated plugins should have updated their themes and plugins long before that date but they never did as they did not know the issue. The rev team kept it quiet for a good reason. Unfortunately that backfired because of the way sucuri dropped it on the internet in order to gain as much publicity for their own business sales model. Sucuri should have contacted envato and the revslider team instead of dropping the leak on the internet putting all none updated websites at a great risk. Their sales benefit from it. I consider that a very bad way of doing business. They posted the leak As fast as they could open on the internet. They even posted the way to use it and get access to the sql database by the admin ajax call. How stupid can one be todo so? Thank you Sucuri ! (Not). The solution was simply update the plugin or theme with the plugin.

But then again if a plugin updates and after 6 months the theme with the bad integrated plugin still is not updated or even users that bought the plugin did not update them then who is to blame? They all got more then one update notification since feb 2014, but they just neglected them. I have seen many themes updating the revslider in feb 2014. They never had the issue more then 2 weeks after it was discovered by the rev team.

How different this was when the prettyphoto vulnerabilitty was discovered. It was silently brought to envato by somebody who discovered it and all the themebuilders and plugin builders using the script got a email to fix it which they did. It simply said security issue fixed in their update list. No big fuss like sucuri created. The developers where forced by envato to update otherwise their product was taken offline. Its a way sucuri could have taken. Instead they wanted the credits, big publicity and sales for their own product. To me that stinks even more then the security issue itself.