In reply to David McCan.

Google can remove an app from your phone if they realize it has a security issue. An option to signup for something similar from WordPress.org, when a hosted plugin or theme was found to have a major security issue, would be of interest to me.

Both remote-killing and automatic updates have taken place for extreme security issues with plugins in the past. It's a capability that the WP.org team has, but it's one that's taken very seriously, as it is basically a nuclear option.