Perhaps with a hidden preference, for people who absolutely need an old version (to run some internal business app that fails with new versions, for instance), but by default?
First, click to play for vulnerable plug-ins will make driveby exploits less likely to be successful.
Second, it gives users some protection while while they wait for a time to upgrade a plug-in that's more convenient to them.
Third, we've learned that if you simply take the plug-in away, users don't upgrade, they switch to one of the other browsers on their system which isn't taking their (potentially similarly vulnerable) plug-in away.
This is not the only answer, though. It's a step in an ongoing process to protect more users and one that I believe all browser vendors are converging on.
That make sense, and that sounds like the real reason. The first two reasons would work just as well with disabling the plugin entirely without the click to bypass. However, if you think people will ignore the warnings and run another browser entirely, that seems like a good argument for letting them use the plugin with Firefox, as long as you have an appropriately severe warning about what it means to let a site access a vulnerable plugin.
An informed user can also make a judgment depending on how trustworthy they think the site is.
Just to give an example, Flash on ARM (non-Android) is old, however, most of the attacks won't work, due to the different architecture (that's not to say it's safe, just that most people aren't targeting non-android ARM devices yet.)
The odds of seeing any sort of update for it (I think, but don't quote me on it, it's version 10 or 11) are slim to none based on Google not releasing a version of Chrome for non android devices, nor does Adobe do the work of preparing Flash for these devices.
I'm not saying these machines are worry free, but I definitely don't concern myself near as much as for my amd64 boxes