I don't think these results will surprise anyone experienced in security who has glanced through the plugin repository.

The solution IMHO is education. There should be more promotion of blog posts teaching security basics. Most developers creating insecure code just don't realise they're doing it.