This happened to me too. Instead of just contacting me directly about what they thought was an issue with the plugin, Plugin Vulnerabilities published an article about it on their website. The plugin was then temporarily withdrawn from the repository. The issue took less than ten minutes to resolve, but it then had to be manually approved by the Plugin team before it was made active again.

That took weeks.

New people could not download it, but existing users could not install the updated version. If there was a security issue, I had no way of alerting users of this fact or getting the updated version to them.

The way Plugin Vulnerabilities handled the issue was the complete opposite of how open source is supposed to work. Discover an issue with my code? Great! Let me know what you found and let me fix it so the issue doesn’t do any harm. That’s not what they did.