@Rob Lawrence - Yes and no. We review all plugins as they are submitted, but we don't do ongoing approvals for releases. If a plugin is insecure (like that text only password is readable to anyone via XSS or other methods while not being logged in as a permitted user) then we reject them. If you find a plugin like that, or one that breaks the guidelines for the WPORG repo, you should email plugins AT Wordpress.org with the details. Link to the plugin, tell us exactly where the problem is, etc :)