Can someone please explain how an inactive plugin can be considered a security threat? I thought they cannot execute code and are perfectly safe to keep around. I will have to remove about half a dozen of those from my sites now!