The Block Bad Queries Plugin hasn't been updated recently. Is WordPress still subject to these types of malicious attacks or has it been hardened sufficiently to make the plugin obsolete? Is there an alternative?
Yes it is still relevant, WordPress is very subject to query based attacks. It is more common and easier to attack bad plugins/themes, so even if your WordPress version is kept up to date, it's still a good idea.
There is a better plugin called Mute Screamer, it uses a central PHPIDS database.