Another problem of this whole episode that not an awful lot of people tend to see is Child Themes or should I say the lack thereof?

Many of the people purchasing WP themes on Themeforest don't know the how, what, why on Child Themes. You think they make one after buying any of the list of 1K+?

No, they don't and because they don't want to lose their site, they cannot update their theme.

It is therefore irrelevant of the author of said theme has or has not updated it to patch the security of Revolution Slider. As long as the user is not made aware of this issue, these remains a gaping, security hole!

Every week I see websites with crappy Themeforest themes installed and maybe 95% of those does not have a child theme setup.

How is Envato going to contact/protect those users?

I have said it a few times already and I say it again: Envato is ultimately responsible for this security disaster and the only just thing they can do at this point and per immediate is to forbid themes bundling plugins.