I am perfectly certain what this fix does and it certainly does not create a security risk. We also supply many WordPress plugins and hinestly the only poor practice here is the non-response from the developer. I appreciate ALL the moderatorsr and their efforts. As a provider responsible for 100s of domains, I have the following issue:
1. The developer should never have forced V3, that should have been a toggle
2. Because it went to V3, we actually had to generate new keys for every domain and adjust the configuration.
3. To revert back, we need to do step 2 all over again
During this entire process our clients are sufferring.