Well, they banned Wpengine from updating their package in the repository. Then the package maintainers found security problems - which they can’t fix with an update because they’re locked out.

It makes a weird sort of sense. Ie, wp.org backed themselves into a corner where they needed to close the security hole. And to do that, they needed to patch it themselves, which in turn requires them taking over the package.

It’s shocking, yeah. But it would probably be worse if they just left the (known, publicised) security vulnerabilities in.