I don't understand what this plugin does that you can't already achieved with the plugins it's supposedly supports. You can 'become compliant' with the likes of Contact Form 7 and Gravity Forms by adding checkboxes with privacy statements in their respective form builders and ensuring you handle user data correctly and safely.

From what I've read, this plugin just adds another layer on top of these contact form plugins (plus WooCommerce) which seems to just add complexity and in this case scenario, a vulnerability that could have been avoided.

Van Ons said they requested the Plugin Directory team do a forced update but they said it was not an option in this case.

I'd imagine this may have something to do with the fact that auto updating the plugin may have masked the need for some people to do a full post-mortem of the hack they suffered and left admin accounts and scripts lying around. I don't see any other reason to prevent an auto update to affected sites.