I'm not exactly thrilled with premium plugins being packaged into themes but this is such a silly statement: "Users can protect themselves from situations like this by declining to purchase themes that bundle plugins/functionality."

With the same logic, users shouldn't use any product that has ever had a security flaw. Like WordPress itself?