1. The data started in January 2013, so it's possible Gox was hit much harder in previous years. Although that would also mean the amount of time they spent oblivious to the problem increases.
Who said they were oblivious to the problem? They may have been operating as a fractional reserve since before 2013.
You can have unit tests, speed execution tests and all kind of tests to see if a plugin is good or not.
Yes, you can test plugins for everything you want. That is easy, as long as the "what you want part" is well defined. Finding out what exactly you want these plugins to do is very difficult. OP says the program "pays humans to do things that it can't do". In order to ask humans to do such things, it must be able to get a grasp of what it cannot do, which is actually harder than doing these things in the first place. Here's a book that offers some good insights on this matter http://en.wikipedia.org/wiki/I_Am_a_Strange_Loop
A program writing programs? I think we don't have that yet (well, there is https://en.wikipedia.org/wiki/Evolutionary_algorithm but from what I read in another thread DAC-related, it takes huge computational power).
Evolutionary algorithms are just one kind of learning algorithms. There are many others, such as neural networks, swarm techniques, etc. They mostly fall short for really hard problems because they cannot handle sufficient complexity yet.
The general principle would be that it pays humans to do things that it can't do, so people are incentivised to work for it when it needs work. For example, the software would need to adapt to new VPS providers with different APIs, so the software could offer money to anyone who can sell it a plugin that connects it with a new VPS provider. This would ensure that it could move between VPS providers even if they disappeared. (things like receiving some plugin code from a user, testing it, and paying them if it works, could all be feasibly automated).
You're assuming the program is not smart enough to write the plugins. This is a very reasonable thing to assume. Nevertheless, the problem of determining what plugins it needs is actually harder than writing these plugins itself. Think about it. So you don't need a program that can outsource plugins to humans: you need a super-intelligent program that can do everything itself.
Since a computer virus isn't much different being code at the core, you could very likely build a self-replicating contract that can auto-execute other functions. Ethereum contracts are essentially autonomous agents that can perform many functions.