If deactivated plugins are marked as insecure because they might have a vulnerability then do these same plugins become more secure if I re-activate them? Nope. So why are deactivated plugins scored any differently from active ones? They have the same objective level of vulnerability. The only difference is an assumption that they are not being watched by the site admin, but does that really have any bearing on the threat level?

There are certain dev utility plugins which I keep deactivated on client sites and only activate them when I am doing maintenance. I deactivate them just in case they are hooking in and using 1% of resources in wp-admin, or for a number of other reasons . For example: many plugins clutter the sidebar, or a client may have admin rights and I don't want them seeing Query Monitor, or doing a search and replace!

I'll now have to remove those plugins and reinstall them every time I need them.