In reply to mark k..

It was untested (or very poorly tested) code pushed to half a million installs, without any notice. Without that untested code, the exploit of being able to activate 3.0 without having admin permissions would have been just a forgettable curiosity, with it, it is an actual problem.

We are talking here about half a million sites here that are in risk, not 5k, and from what I can read in the stats, a week after the updated release and the forced update only 25% were upgraded to latest release. And all those people were put in risk because someone had a great idea how to shortcut proper development cycles.

Also never, ever, ever will I condone the public “whipping” of someone because they made a mistake and put some code in a plugin that shouldn’t have been there or contained vulnerabilities.

At the outbreak of one of the latest plugin related security issue someone on slashdot summed it nicely "wordpress is not secure out of the box and you need a security plugin to make it secure, but if you want a secure wordpress site you better not use any plugin". It doesn't matter at all if it is true or not cause this is what the tech world thinks about wordpress, and that forgiveness that you show makes people in the wordpress ecosystem think that it is ok to write insecure bad code, therefor justifying the above view of wordpress security.