Note that, if you're using a Theme downloaded from the official WordPress Theme Directory, you have nothing to worry about, since directory-hosted Themes cannot bundle TimThumb.

There's really no good reason to bundle TimThumb in a WordPress Theme anymore. 99% of what it does is redundant with core functionality. I wish commercial Theme developers would figure that out, and stop bundling it.