Just putting a reason or a public page on a removed plugin is not enough. How many times after you've installed a plugin have you gone back to that plugin's page on the repo? In most cases, I would think, that would be zero. So you would never know it even got removed, much less why.

The are two responsible solutions to this problem as I see it, and both are necessary.

1. A notification must be shown on every site's Plugin admin page that is using the plugin. Just as though the plugin had an update, it should have a link that shows "Important Notice" or some such wording instead of "There is a new version available". And of course, that notice should be linked to some sort of notification that the plugin has been removed and why. (Don't even tell me that would make security worse. Please....we live in an age where disclosure is the right thing, not the wrong thing).

2. If a plugin is "removed" permanently, a version that is reverted to a known-good version or a fixed version should be put in its place, and frozen...just as was finally done in this particular case. I like the way they finally handled this one.

It's kind of insane that current users of plugins removed for security reasons never ever know that there is a problem with the plugin they are using, unless they just happen to run across someone talking about it on a blog or social media somewhere. That's.just.crazy. Notify users, dang it. NOTIFY USERS. Geez.