In reply to Daniel James.

About time, there are more targets around just waiting. Lots of bad coded no-extra-value GDPR spam plugins, lots of Gutenberg mega-blocky-thing spam with similar code-quality far from any wordpress code guidelines... only due to low installs nobody cares, yet.

Another problem in repository, there is currently no way to also push/provide an update with a small fix within an older branch of a plugin, e.g. after an incident.

Some already exploited plugin with 100k+ installs still has 30% users on an older major branch, still vulnerable to full RCE, because the newer branch release of the plugin broke compatibility too hard for existing sites, so users simply stopped updating.

Fun times, if you are evil.