We included a spec in our rails app that inspects all AR models and errors if any don't specify any attr_accessible (with a whitelist of models to ignore). This catches anything included by plugins too, which can be helpful.
https://github.com/instructure/canvas-lms/blob/9b52a51b6a37e...
This is definitely a first step.
The thing is that with 'attr_accessible' a lot of interaction with your models gets harder (think testing or working from the console).
I tried fixing this with introducing roles that have access to all attributes. Source at https://github.com/eval/sudo_attr_accessibility
Models: find app/models -type f -name \*.rb | wc -l
Models with attr_accessible: grep -r -m1 "attr_accessible" app/models | wc -l
If those numbers aren't the same, and the missing model files inherit from ActiveRecord::Base, then look into adding attr_accessible.