In reply to Chris Christoff.

Thanks Chris for the info. Vladimir I agree, I'm more just wanting to learn and understand how this all happened and if it was preventable by either WordPress core or plugin developers. Updates will always happen and these rush updates for security will happen so how can we make this a smoother process.

My personal take on this is that the auto update should happen for website owners who don't have a dedicated web developer who does their maintenance, otherwise that should be the responsibility of the web developer.

Have auto updates enabled on none supported sites by a developer.
Turn off auto updates if a developer is maintaining it. Therefore this option should be optional.

There should be an email to all plugin developers giving them a heads up of the changes maybe 24 - 48 hrs ahead of the update regardless.