In reply to Stephen Feather.

If you are referring to the Freemius library, we warned the developer about the flaws more than a year before they finally fixed them. We found them while doing a security review of a plugin using the library. Unfortunately, catching security issues doesn’t mean they will be fixed.

Considering that plenty of the biggest plugin developers are not getting their own code reviewed for security issues, it seems unlikely the developers are ignoring the vendor directory. They are just not checking things in general.