In reply to David Anderson.

My sentiment exactly. I really think WordPress plugin developers should push against these sorts of reports.

It’s misleading, and they are hurting the ecosystem just because they want to sell their security plugins.