[DoubleGlazing]

I agree, If I were an IT manager this sort of stuff would make me start looking at alternatives.

If an app/pluging/package is maintrained and published by X, I want to make sure no one else can interefere with it - even if they have good intentions.

What Automattic should have done is removed the plugin from distribution and told WP Engine to fix the problem. By doing what they did they have breached the trust of their users.

[gtvwill]

This is gonna be a hard move for some of the IT companies I've seen who have based their entire business around WordPress websites. They literally don't have the skill to use anything else as WP is all they know. Rip.