The TRT seems to have screwed up but not necessarily by suspending the theme... but by waiting. Had they taken this action ASAP after finding the issue the number of users affected would be much smaller. By dithering around for 16 months they share responsibility for the impact. There's no shame in having mistakenly approved the theme - humans aren't perfect, stuff happens. But if people are going to make the argument that letting this go on for more that 16 months simply increases the magnitude of the problem well, so did letting it go on for more than a month, etc.

Caveat: Not read the trac ticket, so if this was only discovered recently, eh. But if it was discovered early on, the theme should have been suspended right away. Hopefully, the TRT will, if a suspendible violation is found, be more prompt in removing a theme while at the same time working with the dev to address the issue.