I do see various security fixes in that patch, but most of the changes are removing references and code for a "pro" version of the plugin. I'm guessing the WP

I do see various security fixes in that patch, but most of the changes are removing references and code for a "pro" version of the plugin. I'm guessing the WP security team has been pentesting any WPEngine code they could get their hands on to find an excuse to make all of these changes. The security issues do look bad (once again proving that WordPress' worst vulnerabilities come from the plugins they install) but I think the branding removal is pretty wild. A quick skim through the plugin development guidelines does seem to indicate that trialware isn't allowed, and the plugin seems to be doing all kinds of other stuff that isn't really permitted by the guidelines. I don't know if WordPress is as strict in enforcing those as they are with this plugin, but the changes do seem to be based on them. With WPEngine recommending people to install their (vulnerable) version, I once again feel like there's no right side in this conflict. What a mess.