In reply to Donna Cavalier.

Actually, no, "Plugin Directory Representatives" do not have the obligation to inform users regarding issues like this. Plugin Directory Representatives have taken it upon themselves to remove dangerous plugins. It is the responsibility of the Plugin Developer to correct the problem and get the plugin back online as soon as possible so that vulnerabilities are remedied.

Easy solution:
Upon notification of a problem to the Plugin Developer, that person makes the correction. If you want to be upset at someone for the plugin not being available it should be at the person who is too busy to fix the plugin they have available to the public.

Regardless whether the developer is upset with WordPress or not, the person or company placing their plugin in the Repository has the obligation to those using the plugin (if there is any presumed obligation).

Gimmie, Gimmie, Gimmie is not the best approach to solving issues, IMHO.

We always have the choice to use another project for what we want to accomplish online. That's the way I look at it.

Too much expectation is being thrown upon volunteers who do a great job (however you may look at it), who also have a regular job on top of providing a free service to the public.