All the talk above about removing unsupported plugins misses an important thing here: WordPress checks for plugin updates, and if it can't find the plugin in the repository, it just assumes it's up to date.

Until such time as the repository and WordPress itself can show that a plugin has been removed and can no longer be assumed "safe", old plugins should stay in the repository and simply display the "hasn't been updated" message. That also allows users to continue logging issues in the support forums, which can serve as a warning.

As it stands now, when a plugin is removed from the repository due to a security vulnerability, any sites using that plugin can carry on using it with no indication that it could compromise the site.

IMHO, this is a much bigger problem than some old plugins that haven't been patted by their authors for a while, but still work. I mean, it's not as if a plugin being new or even receiving updates is any indication of its quality, eh?