I guess one way to read this (and I'm not saying it's the correct way, but I think it's plausible from what we know) is that the actions of Ruby Central (npub1adh…8lgh) on the 18th of Sept did exactly what we've been accusing them of and exactly the opposite of what they've been saying: it made rubygems considerably less safe.
The one thing you cannot have is a situation where you don't actually know (for 12 days!) who has access to what and why.