Penetration testing is the only way to avoid security breaches when you have many hands in on whatever the sites complete codebase is. If you have plugins from many developers then you open the doors to security matters. I explained an experience of ours with Joomla and a particular State level political campaign. We were overnight threatened with a 2 million dollar lawsuit and due to an inadequate disclaimer drawn up by an attorney it would have stuck. Standard form if limited liability disclaimer. However, we failed to mention and have them sign off on the external components/modules used on the site NOT coded by us. That makes the disclaimer null and void if it were to go in front of a judge here in the USA.

There are many free penetration testing out there and many paid ones. We use Fortify by HP and got a real break on it as Xerox corp and HP are "tight". In fact, it came about due to that breach. Xerox ran the penetration testing against the defaced site. They found several security holes.

The simplest "quickie" fix is probably anyone who downloads a plugin has to insert an email address thats valid, in the responder email have a link that validates. The email address is then saved by the repository. If a security issue crops up then all who downloaded the plugin can get an email about the specific vulnerability. At least reach more people that way.