kde-apps/plasma-runtime depends on dev-qt/qtwebkit:4 which is ancient and will never see any security updates. plasma-runtime itself is of no use for in-tree Plasma versions and is currently blocked from removal for a single rdepend.
commit fc2b734215c6b0c9ac255cef6f5a7761a7148a59 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: Wed Jul 5 11:52:40 2017 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: Wed Jul 5 12:00:09 2017 kde-apps/plasma-runtime: Remove last-rited pkg, #620792