- It was an upsell to the Pro version of free plugin. Not some random ad spam.
- The ad was an admin notice - which appear in WordPress on top of every page in the backend Admin Area in what's generally the notification area.
- It's free, GPL, and open source - you know, "No Warranties" and all that.
Grayhat, and not something you should ever do. But not as nefarious as everyone is making it sound like.
WP.org is about freedom, so they're unlikely to restrict it either unless malicious: https://github.com/WordPress/wporg-plugin-guidelines/pull/69...
Being very involved in the WordPress industry, what I find funny is the majority of angry reviews masquerading as victims are from entitled pseudo devs who sell WordPress sites to clients and now they were made to look bad because they had automatic updates enabled while charging their customers for a retainer package with "plugin & themes updates".
How about buying premium version in the first place just as you charged your client for it.