In reply to Jeff Chandler.

@M

1. This is web security 101. No one except for an admin of a server should be able to change the code running on it. That simple.

2. After you were hacked no update will help you

3. Have you ever read this https://wptavern.com/display-widgets-plugin-permanently-removed-from-wordpress-org-due-to-malicious-code? The idea that that some plugin author might have sold the access to his plugin, or they were phished from him, should keep you sleepless at nights.

4. And it is not only malicious people which are the problem... how many sites went broken after update to version 3 of ninja forms, yoast and woocommerce (guess 3 is unlucky number in wordpress plugins)

5. And even without bugs, in one of my plugin I removed support for php 5.2 guess what happened to people that auto updated.

Auto updating is one of the things that seem like a nice idea on the surface but turns out they have horrible security implications.