This is a random thought I've had today. Here's the scenario:
I've got a plugin on the WordPress store with 100+ active installs. I recently updated the plugin and pushed the changes to the WordPress SVN. Around 60% of users updated the plugin in the first couple of days - but what's not to say that I could have updated my own plugin with malicious code? For example, my plugin lets users create a phone number shortcode - but in the update, I could have changed the code to check if a plugin such as WooCommerce was installed and forward on their customer data to an external location. Are there procedures in place to prevent such things?
It worried me slightly because I have many plugins written by other developers on my website and I update them without checking what changes have been made all the time!