In reply to Arūnas Liuiza.

I wish WordPress.org had a better (or any, for that matter) API to handle those things

I have no argument with that!

It's very concerning to know that, for every plugin on your site, only a single password needs to be cracked in order for someone malicious to slip an evil new version onto wordpress.org, which people would start updating to instantly.

Sure, it would hopefully get caught, within a few hours probably (a clever attacker would time his release for the sleeping hours of the plugin developer) - but with big plugins, that's long enough for the malicious actor to slip his evil code onto thousands of sites. So, there's a big prize, and a low barrier...