This is not going to be a mess, it already is since plugins are not updated and give no warning an update needs to be done.
If there is no mechanism in place that checks for updates soon we’re going south. I wasn’t aware of this. I think CP should stop offering the connection to the WP repository a.s.a.p. and replace it with it’s own “plugin section” in the dashboard. Apart from that it should “flag” the plugins installed as “no longer supported” (if they are). Preferable not in the plugin section itself but at the start, when a user opens te admin page. So users would at least be aware of this.
This is of course breaking away from WP – but that is, or was, of course inevitable this would happen one day. Time to cut ties with Wordpress I’m afraid.
Also – recommending WP plugins for security? Mmm… I recently installed Shield Security and I love it. But what if a plugin like that also stops supporting CP (a.k.a. WP 4.9.x) without any warning? People trust their website is safe and secure but if the security plugin is outdated… 
Not having a good mechanism in place for these issue might be a real break-point one day soon and be the end of CP. As in: people will no longer switch to CP.
I’ve been enthusiast about CP since it’s early start and have it installed as CMS for several websites but if this isn’t resolved any time soon it will probably mean I will need to go back to WP. And I won’t be the only one I’m afraid. You can’t expect business to run CP if this means they run outdated plugins without knowing. In that case I can no longer suggest CP as an alternative for WP.