@Jeffro -
For what it's worth,
1. I think this is a perfect discussion to have.
2. The plug-ins directory was started at a time when malicious behavior didn't out weigh the standard user 6 to 1.

If someone comes across a plug-in that is "Malicious" Some type of action should be taken to blackball it. It does not to the Wordpress reputation any good when something like that is uploaded from their site, nor does it do anyone any good for future endeavors, you've no idea how many plug-in's now are becoming *not* available to users because they require access to the webroot, and users in a standard multiple hosting environment are not given access to even their own webroot anymore.

So, again, here we have the situation where "the actions of a few" are detrimental to the whole, personally, I'm getting really fed up with that scenario, and it's hardly a motivation for keeping ones ethics in place if everytime someone else screws up, I get punished for it too.

I think your post is perfectly valid, and community wisdom seeking, and community best-interest motivated. So Kudo's!!

@Michael - quite a number of years ago a person who had a THRIVING business of selling gamming pieces out of his garage sent me his website and database to design a new one.

In that, he had all user names/pw/cc numbers/expiration dates everything, non-encrypted in a non-compiled website. i.e. just a website with an access database for the information.
This person not being really very smart on the one end, was really brilliant on the other. Oh, and did I mention he sent this by email to me and maybe 15 people before me. If he sent it to one after me I'd be surprised.
Part of our job includes the responsibilities that go with it, no different than a doctor or a lawyer, and most of us with no-less educational years.

@dave wp evil -Yes, there's no privacy online, that's why @EFF fights for us everyday and why the White-House just stole twitters attorney.

See, what allot of people forget is it's just not people in the US, and what if some African country's polit-bureau used this plug-in, and saw real-names of people who were uploading the articles, it would be death to another journalist. (granted a stretch in this case never-the-less)
Simple security issues don't seem to make a big difference here, but they can literally mean life or death to people and their families and their friends in other places. ref: cpg.org,
#SoberingThoughts