There are still plugins in the WordPress repository that bundle timthumb still. I was looking for a new related posts plugin earlier this year, and after downloading one to test it out, I was shocked to read through it and find that it was using timthumb (Contextual Related Posts, if anyone needs to know).

I immediately disabled it, deleted it from test site, and deleted it from my computer. No one needs to use timthumb anymore, and after having had to clean up after an exploit several years ago, I won't subject myself to it anymore, no matter how many assurances are constantly given about it being "fixed".