Usually in web arenas staying with the most mature latest stable is best as core code security is usually the first of issues that appear. So WP 4.2 comes along if a site is critical dont update for 4-6 weeks.

Run security audits against the site(s) with something. Lastly hosting providers can also make a difference depending on what security they have in place. While more than likely not able to pick up on this particular cache plugin flaw there are some really great host providers with hardware firewalls. It depends on how important security is to your needs. Some defaced blogs can readily be restored. A breach however in say a commerce venue where peoples information gets exposed can be a kiss of death.