He didn't say they made it, he said they _own_ it.

The issue was not that forking of ACF in and of itself was controversial. It was that they hijacked and repurposed the original WordPress Community page and distribution to point to their own, including any subscribers to the existing project in the name of "security".

One could argue that because WP Engine was banned from accessing the WordPress.org infrastructure, it could technically be seen as a form of supply chain attack and brought up questions about trust and possibly monopolistic and anti-competitive behavior.