We added extra security to the path creation to 3.2.9, but it looks like there may be an issue with windows servers. This plugin is not tested on windows servers only apache.
So the short answer is yes, this could be a bug for windows servers. We will look at the issue
In the mean time you could use
$despath = $pathinfo['dirname'] . "/_resized/";