How about adding one more step in the whole process on wp.org - notifying users who downloaded plugin which turns out that is malicious at some point? Removing the plugin from the repo and notifying the developer is not enough in this case.