“That Automattic would unilaterally decide to hijack such a popular plugin is completely insane. I’m not sure how this differs from a supply-chain attack.”
Mullenweg invoked “point 18” of the plugin directory guidelines to take over Advanced Custom Fields, a plugin owned by WP Engine, the company he is feuding with. Automattic first blocked WP Engine staff from WordPress.org, then cited a security fix the ACF team could not ship because of that block. The GPL allows a fork. It does not make the fork the thing your users trusted. Every plugin on WordPress.org now ships at Mullenweg’s pleasure.