This incident shines a spotlight on how unregulated the commercial plugin and theme ecosystem is and how little protection users have from companies that abuse their power.

You can just leave off “commercial” in that statement and it still holds 100% true.

all of the plugins go through a security review by the WordPress Plugin Team.

This only happens on initial submission, and it’s only a superficial review. This is why situations like the one that happened to the Display Widgets plugin are able to happen. And why new vulnerabilities are discovered every week in WordPress plugins.

While it is easier for these types of things to go unnoticed in commercial plugins, this is an issue with the entirety of the WordPress plugin/theme ecosystem. And it’s something that is not going to get better until the community and WordPress leadership decide it is a priority and put resources into cleaning it up.