In reply to jasonjudge.

> The fact that wordpress.org credentials need to be passed over to a third part to store

They don't have to do it that way. Plugin authors can grant and revoke other users commit access to their plugins if they like. They likely just implemented it in this way because easiest, is all.