Well, this is interesting but in the end it's very much apples and oranges.

Not running the current version of Plugin X is actally not the same as site / install being venerable. They might loosely correlated but that's still not cause, simply correlation.

Helpful? I suppose. But we're still not there yet, and perhaps not even close.

p.s. If more plugins used OOP then retroactive security updates could "fix" older versions but leave older - probably more basic - functionality intact. That is, you could, ideally in theory, safely run not current versions and not be any more or less at risk.

Ultimately, this whole problem is a product development and product architecture (is you will) issue and not strictly a security issue.