LOL… Tony, the damage done here sounds more like an error of the webmaster than the author of one plugin he uses.
If he updates the core and does not check at all if the dependencies work (no matter what it says it is compatible with, but on top of that, it was clearly not much tested with the latest WordPress), then you are playing with fire!
If it is really a 28k+ users website, then you have to manage your upgrades a better way. Of course, you cannot re-test everything efficiently. But hoping nothing will break sooner or later and have no revert plan, and then blame the others, then you are a big reason of the problem, and you have to learn to be a bit more prudent, or develop the skill to be able to fix, revert, or whatever (or at least have access to a ressource that does).
Plus, it only affected the password retrieval part, and not the login/registration if I understand what you guys said. Maybe it is a feature widely used, but that is not the main one and you can always do a quick fix until your _dependencies_ adjust.
bluedotproductions make me laugh when he said “I feel this is an emotional reaction as you defend a broken plugin.”… if someone react emotionally here it is you, since you react after you found out a part is broken.
The author is right in saying that the purpose of review is to rate the plugins itself, and not a reaction to a punctual problems, but we are not gonna make people smarter or understand that as it is pretty common to do this. You have an issue, communicate, wait, and see. Reacting that way won’t do any good to no one. C’mon…