You said that in the portable version that you can install plugins manually by copying SH3P files at the right place. Where is the right place that you say to manually copy them to?

In the data/plugins subfolder of the folder where the portable version is available.
But don't get confused between the portable version and the JAR executable version. The JAR executable version doesn't comes with a JRE and uses the same plug-in folder as the installed version (see the section Adding plugins in the user's guide).

As for you including both 32-bit & 64-bit executables in the portable version, maybe it would help to make 2 portable versions: one that is multi-platform but only 32-bit, & one that is multi-platform but only 64-bit.

For me, "portable" means that you have in one folder all the executables required for all the systems (and not only for Windows). If you release one portable version per system and architecture, then it would be less portable...
By the way, I already release more than 10 files at each new version (installers for multiple systems, portable version, JAR executable version, Java Web Start version, applet version, source code). I hope you'll agree that it's already quite a lot!

For those of us who only have 64-bit java on our PC's, I hope that everybody knows that java recently found out that version 7.10 is vulnerable, & to uninstall it & install version 7-11 instead.

This issue concerns only users of the JAR executable, Java Web Start and applet versions. Installers and portable versions are bundled with their own JRE.

I think that 32-bit java automatically gets notified of things like that, bit 64-bit java can't get updates, so people with only 64-bit java might not know about this security threat.

Why 64-bit JREs wouldn't be able to automatically get updates?