In reply to Donna.

I fully agree that following these 2 steps would be a great solution for cases like this.

It should already be possible for the security team at wordpress.org to push out automatic plugin security updates so sites will update affected plugins in the background (like core):
https://make.wordpress.org/plugins/2015/03/14/plugin-automatic-security-updates/

Plugin readmes also have a section called "Upgrade Notice" but as far as I know, anything written there are not parsed or displayed anywhere to the user. That could be used to display important notices for a specific update, but as plugin developers can change the text themselves, I could see how it could be abused.

As with everything else, communication is key.