I've read many WordPress Security blog articles, where the Security Experts're recommending some special matters to take care when somebody is concern about his/her WordPress site's security. Among them one is:
WordPress Security Tips:
Remove unnecessary plugins, that are not in use
A plugin that has security holes, whether by code or structures or db connections, can be fatal for a site even it's activated into a site - on the other hand, a well structured, well coded, securely db-connected plugin may not have a security hole even it's deactivated. So where the issue exactly is?
I've a site, where there are some plugins, I use them occasionally. I actually don't want to delete them, but when they are not needed, I just deactivate them from the site. Do I need to delete them to secure my site?