And how do plugin developers get their plugins back into the repository if they've been pulled due to a security bug but later fixed?

AdRotate was pulled, fixed but the developer has been having a hell of a time getting it back in the repository.

I don't know the guy, I use his plugin and it's a shame Arnan has run into a dead-end. His dealings with WordPress.org remind me of how it is to deal with Google. I must admit that me myself when I've had an issue with something like the Intense Debate plugin I got an email from Matt himself apologizing. Personal reply or boilerplate letter it doesn't matter as it was still a quick response and I'm grateful for WordPress.org for being responsive.

You can read about Arnan trying to get back into the plugin directory here: