one of the security fixes for 3.0.5 created another problem of stripping HTML on display from people with the unfiltered_html capability

It's much, much more specific than that. It only affects advanced HTML (like image tags, which are normally forbidden) in comments made by Editors or Administrators on single-site WordPress installs. So it makes them behave like multisite installs, which forbid everyone from posting advanced HTML in comments. And it only does it on display, so there is no data corruption.

Most people don't even know that Editors and Administrators can post images etc into comments. It's not a frequently used thing. We decided that although it was frustrating that the bug slipped in, it was not severe enough to warrant another release. The Akismet team was planning a release that day anyway, so we asked them if they'd be willing to incorporate a quick hotfix into the new version. But I also wanted to offer a standalone solution for the minority of installs affected that didn't require activating Akismet. So, as I've done in the past, I created a Hotfix plugin. Except this time, instead of targeting the entire plugin to a specific release, I made it generic, so that it can push other "not worthy of a release by themselves" fixes to people sooner than they're otherwise get them. It's opt-in. It doesn't change our release decisions. It's just a more attractive solution than "use subversion" for people who are affected by the bug.

I don't want to bundle any new plugins with WordPress. Quite the opposite. Plugins have their own update procedures and release schedules and I think that plugins should be omitted from core updates. Maybe even from the package (note: just my opinion, there). We're going to be discussing that (and many other things related to updates) in the 3.2 cycle.