seems like the maven-resources-plugin was the only one without a version.
No, the QDox POM does not specify versions for maven-clean-plugin, maven-surefire-plugin, maven-install-plugin and maven-deploy-plugin. So, for Maven 2.0.8-, these plugins get resolved to their latest release, while in Maven 2.0.9+ you get whatever has been set in the super POM. In both cases, your build depends on external settings and a different Maven version could produce different outputs from the same POM. Locking down plugin versions is not limited to just the plugins explicitly declared in the POM, it should be done for each plugin your build uses, including the implicitly used plugins for the default lifecycle bindings.
Considering the Enforcer Plugin's FAQ, I'm not sure that <prerequisites> is the best way to go. Maybe use the plugin's requireMavenVersion instead. This would IMHO more clearly express that it's a build requirement, not a runtime requirement.