In reply to Jan Dembowski.
Obviously there is no working security concept at wordpress.org

Any plugin which is disabled in repository due to security problem should show exactly that reason on plugin page, and expecially also in WordPress backend in plugin list.

Any plugin which is disabled should get a forced changelog entry which explains this problem.

Any plugin which is disabled should get a CVE assigned by wordpress.org dedicated security person which is NOT an admin or moderator in forums.

Current approach with “security by obscurity” by silently hiding vulnerable plugins so hackers won’t notice is a) irresponsible and b) completely wrong.