I agree. But imagine the outrage when your schema is wiped out. How about a wordpress release which can automatically "disable" the feature/page/plugin/script that express the vulnerability? And throw in an SMS page when an update happens so it wakes them up right away instead of waiting for them to discover it in the morning.