Is it too much to ask for next time, do a FULL security audit before releasing the next version.

Quality over Quantity.

I know other php programs like phpbb won't release for the sake of releasing.

Yes I know there aren't enough people, most people are volunteers and so forth.

Just don't release core/plugin/theme until you are 100% comfortable that core/plugin/theme/etc...is safe.

If it gets delayed by a week or two, so be it. Give the c/p/t to all the devs and tell them: break it. If they are able, the fix it, repeat for the fix, and if nothing was broken then voila...you release it.