You shouldn't stop theme developers from bundling or developing around their favorite plugins. That's just ridiculous and holds back creativity. The only thing that should be discussed is making the developers keep the plugins, that are bundled, more or less separated from the theme's files so they get updated just like a plugin that was installed on it's own. It's that easy.

I was a .net web developer, I use to build everything from scratch in a past life. Now I use Wordpress and themeforest themes (and other themes) and they are awesome if you get the right ones from the good developers. Incorporating good plugins with a Wordpress theme is really no different than incorporating good .NET controls into a .NET website such as Telerik or Component One. When they found XSS vulnerabilities that were caused by Telerik controls did you hear ANYONE start a fire about how Telerik controls should not be used for .Net websites? No, they got patched just as this will do. The only thing that should be in question is whether the plugins that are used in a theme can be updated easily just as if they were purchased separately. Also, not Envato's fault. Clearly lies on the shoulders of the developers and the end users. Envato is just a store more or less.

Don't hold back a developer from their vision. Revolution Slider is a great slider. I use it often and prefer it over most of the others. What happens when Wordpress has another security flaw? Are all the Chicken Littles going to cry how all Wordpress websites should not use Wordpress anymore? Might as well shut your whole computer down and just walk away from the digital world now.

I use Wordfence and Sucuri plugins, Wordfence has autoupdate activated. All my sites were protected automatically within hours.