In reply to Carl Hancock.

Yes. The people who install this plugin are already security-conscious, and pro-active: which means they're not the majority who have/are the problem.

I think that at least two things are needed:
1) plugin authors should be allowed to push automatic updates. This might be abused - but so can the facility to make available manual updates. If you don't trust the authors of plugins on your site, then you're wrong to use those plugins.
Allowing plugin authors to make the decision is better than either a) automatic updates for all plugins (lots of sites will break whilst you sleep, which to many site owners is all the same thing as being hacked - except that this time from their perspective WordPress hacked itself!) or b) the wordpress.org team making the decision - they can't scale to doing this on tens of thousands of plugins.

2) a header needs adding to plugin readmes to indicate insecure versions, and the wordpress.org plugins API needs to include this information... and WordPress core needs patching to handle it. Users should be shown warnings in their dashboards. Currently, there's no visual clues as to what plugins have updates that are shiny new features, bugs, translations changes... and which are security critical.