Again i believe the sucuri team should have kept their mouth shut until nextgen confirms that most of their websites are updated and added it to the update list. With bringing this into the open they again are responsible for websites getting hacked like they did with the rest api leak in wp 4.7.1 and below and with the revslider 4.2.0 and below.

Their eager to be first with such news is bad for websites using the nextgen plugin. Nextgen had a very good reason not to list this in the update buglist overview.