@Matt:

Perhaps as a community ( WordPress community ) we could do a bit more than that.

You probably have the stats needed to find a working strategy to sequre WordPress installs. The important question is what stops people from upgrading, and what may be done to make people upgrade. We do know that plugin compability and borked upgrades are one factor making people hesitate to upgrade, but what are the other factors and how is it possible to change behaviour.

Theres some discussion inside The Tavern and just upgrading WP is not enough as discussed here: https://www.wptavern.com/forum/general-wordpress/835-wordpress-security-about-more-than-wordpress.html

You should grab a virtual beer with us in the bar, since I at least, talk about yore responsibility ;)

Lets say Matt then. If you make an easy-to-setup CMS with a famous 5-minute-install and have 100.000 or more users installing and running it, without having a clue about servers or security then you also have some responsibility towards these 100.000 + users.