It makes a weird sort of sense. Ie, wp.org backed themselves into a corner where they needed to close the security hole. And to do that, they needed to patch it themselves, which in turn requires them taking over the package.

It’s shocking, yeah. But it would probably be worse if they just left the (known, publicised) security vulnerabilities in.