[bombcar]

I'd say over 90% of it is #3 - if you have auto-update enabled, you're pretty close to secure, unless you run millions of unpopular plugins.