@Jeffro -It's been like this as long as I've been around the community.

An important thing to remember though, is that just because something has an "SQL injection vulnerability" that doesn't necessarily mean that it will be present on all or even most sites. The most common examples of dangerous code I see only affect situations in which users have elevated permissions. The best example of this is in multisite where developers often assume that administrators are trusted users. However in a multisite environment where unrestricted site registrations are allowed, those users are most definitely not trustworthy. However, the number of sites which allow unrestricted site registrations is small and (I would hope) their developers should know to security audit everything they're running on their network. So just because something is an "insecure WordPress plugin", that doesn't necessarily mean it will ever cause any problems for the majority of users.

(I have no idea if the stats Checkmarx is reporting includes users with elevated permissions or not)