I should also point out that any extra files or no longer in use files will not get deleted even by an update unless you first remove code. So as an example, Yoast recent "vendor" directory problem means I am having a fun time manually deleting his plug in from 200 sites and re-uploading it, because just uploading the new version would leave a bunch of files around. If any of them have any security issues (as examples seems to have from time to time) then there is potential that this is a problem down the road. How many other plug in and theme designers have removed unsecure or unwanted files from their updates without telling people they need to delete the unused files?

I smell a ticking time bomb. Something old will come back to bite us all in the butt one of these days.