This continues to expose issues with the THEME > PLUG-IN model that WordPress employs.

If the core could handle a correlation between themes and the plug-ins, then frameworks and child-like functionalities could be updated without any harm to theme/template/core versioning.

Sadly plug-in functionality is consistently overwritten by theme functionality, even when that has nothing to do with templating/front-end. It completely falls foul of the most basic MVC-type separation of data, formatting and processing. Thus almost every theme front-loads it's functionality into the VIEW aspect rather than the CONTROLLER.

For wordpress users who are not plugged in to the core or development, that makes it exceptionally difficult to keep both up to date and track of. In the short term (1 day) this was a TimThumb issue, in the long terms, it's a WordPress Core issue about the management of it's data. A decision that has completely gone the way of WP.com and bloggers.

I'm secretly laughing because when I googled for an article I read which backed this up it came from "he who shall not be named" 14 months ago: http://kevinjohngallagher.com/2011/03/now-theme-disconnect/