The opening paragraph "The SI CAPTCHA Anti-Spam plugin has been removed from the WordPress Directory due to its author including spam code." is misleading, it makes it sound like the person that created the plugin turned rogue, which is not the case.

It was the person/people behind the user fastsecure (a user that was JUST created in June with no history in the WordPress community btw) that "became the new owner" (bought I assume, but no details in the article) of the plugin from Mike Challis in June that injected the code in question:

https://profiles.wordpress.org/fastsecure

"The new owner attempted to put code in several of his newly acquired WordPress plugins" ... Again, no details, it would be helpful to know what those other plugins are so we can find alternatives for those.

I just did a quick look around after reading it and it appears all of the plugins by Mike Challis have been pulled permanently from the repository (in particular Fast Secure Contact Form, which had 400K+ active installs).

Mike also has a statement published @ http://www.fastsecurecontactform.com/

"The incident is another reminder for users to be on alert when WordPress.org plugins change hands, as the buyers do not always disclose their actual intentions for the plugin." seems like a weak suggestion, WordFence this year (for example, I don't use it on any sites, but it may be time to re-evaluate) just implemented a feature to alert site admins when a plugin has been pulled from the repository.

Why did a longtime developer sell to a user with no reputation in the WordPress community?

Why do plugins get permanently pulled even if the current owner corrects the issue?

Why does WordPress pull the URL completely off the repository as though it never existed, killing the downloads I understand, but why not have info related to why that plugin was pulled, and letting users know it won't be coming back?

It's great that the repository admins are pulling malicious plugins out, but there seems to be an enormous disconnect between removing plugins and letting users know what is going on. To me, it seems like there needs to be a system in place for the transfer of ownership of plugins in the repository (at the very least once a certain level of active installs is reached) that involves a probationary period and a fee to cover the cost and time of babysitting new owners (there would be obvious reason for allowing well-established developers to fast track through this process).

The original listings for Mike Challis plugins (via Wayback Machine as the links are now invalid):

Fast Secure Contact Form (400K+ active installs)
https://web.archive.org/web/20170614210930/https://wordpress.org/plugins/si-contact-form/

SI CAPTCHA Anti-Spam (300K+ active installs):
https://web.archive.org/web/20170327201154/https://wordpress.org/plugins/si-captcha-for-wordpress/

Visitor Maps and Who's Online (40K+ active installs)
https://web.archive.org/web/20160207181915/https://wordpress.org/plugins/visitor-maps/

Fast Secure reCAPTCHA (6K+ active installs):