This is a real problem with vulnerability reporting and how plugin authors handle things. The changelog in its current state says;

Escape backup labels. (Thanks to Connum for reporting)

It doesn't actually state that you must update to 7.0 because of a security issue, many will be blissfully unaware of the potential dangers.

Plugin authors need to stop worrying about 'saving face' and tell people they messed up.

I've had plugins with security issues in them and it is a balancing act, you do have to be mindful of attracting exploits against older versions but sometimes you need label these issues for what they are.