In reply to Sarah Gooding.

We’e yet to see anything official published on WordPress.org about this process.

It's in the security whitepaper, published earlier this month, under the "WordPress Plugin and Theme Security" section: https://wordpress.org/about/security/

When a plugin vulnerability is discovered by the WordPress Security Team, they contact the plugin author and work together to fix and release a secure version of the plugin. If there is a lack of response from the plugin author or if the vulnerability is severe, the plugin/theme is pulled from the public directory, and in some cases, fixed and updated directly by the Security Team.