Good coverage of a serious issue-- I think that mistakes which result in security holes are a much bigger issue than malicious plugins. Malicious plugins will get found out and delisted, but everyone makes mistakes, and that is much harder to combat.

What I would like to see, in the case of severe vulnerabilities, is a process for the plugin developer to work with the plugin review team to release an update and then have that update PUSHED to sites running the vulnerable code, similar to the way the Jetpack issue was handled earlier this year.