Thank you for pointing out the good work that is continually being done to help keep the WordPress ecosystem secure. As you mention, it is an ongoing activity that is being addressed, but of course, any ideas that will make the task easier and things more secure are worthy of consideration.

The original author made a suggestion of security bounties. While I don't see that as practical for contributed themes and plugins, it might make sense for WordPress core. It appeared to me that Vladimir Prelovac offered $10,000 towards something along those lines.

Google can remove an app from your phone if they realize it has a security issue. An option to signup for something similar from WordPress.org, when a hosted plugin or theme was found to have a major security issue, would be of interest to me. Having the offender deactivated and receiving an email about this issue sounds wonderful.

An opt-in for automatic plugin updates may make sense, perhaps on a plugin by plugin basis. While some people attend carefully to updates, it appears that there are a large number of people who install and forget.

It is an important topic. Thanks again for writing about it.