I tested multiple versions of the MPC today.
In M6 [1] the D&D feature didn't work today and threw some exceptions that I didn't investigate. It could have been anything, e.g. a change in the web services API, and I wouldn't use this version to draw any conclusions.
M7 [2] shows the same behaviour as the RC builds and the final build of the packages. In all cases, the Finish and the Confirm button stay disabled initially. This is in line with the code change that caused this and had been pushed to Git 3 months ago.
My first conclusion is that the D&D feature isn't popular, otherwise this glitch had been detected earlier. This is no wonder because (a) D&D isn't used very often from web pages to applications, and (b) it is much easier to use the MPC client itself to look for new plug-ins and to install it directly from there. That's workaround number 1: Use the MPC itself. It has been working perfectly in all of my tests.
And what will a user do when the buttons are disabled? The chance is really high that in this case he or she will try to disable/enable one of the checkboxes which solves the problem by triggering an update to the buttons. That's workaround number 2.
And we shouldn't forget that SR1 is only 3 months away, that's about the duration that this bug exists. If this is too long there are other low-risk options, too, that can be discussed.