A lot has been said about how the plugin was swapped out without warning and therefore permission. That's reason enough why this was a bad idea, but just as important, by purchasing WP User Avatar, ProfilePress was not just taking on an existing user base, but buying good reviews and high active install numbers.

That's a review scam. Without those 200 review bombs from angry users, everyone in the repository who is searching for a membership plugin would have been misled into thinking that ProfilePress was enormously popular and well-liked. If businesses are allowed to do with without accountability, the integrity of the WordPress plugin repository will be completely destroyed.

That's why even though judging when an update is big enough to be a different plugin would be really difficult, this behavior should still be banned officially.