Themes being PHP code or plugins being hosted on wordpress.org without any code review isn't beyond anybody's control. Of course the former will never be fixed, there is no deprecation policy.

But yeah, if you have to host such software virtualization and isolation is a good idea.