I'd say this would be on the Important but not Urgent list. They'd definitely have to pay someone to keep up with it though. Possibly going back to the older, less popular plugins and do them first. Maybe even cut off access temporarily. That way they can clean up plugins not in active use to disturb the least amount of people at a time.

Ron & I were just discussing about maybe even better idea is to have approved plugin frameworks for plugin devs to learn from properly the first time around. many of us got our feet wet by example code. If you start from a bad or unsecure example, you'll just write more.