It’s an exploit, not help from plone.org or the sites.
This exploit allows them to run Javascript. When they do that, they create what they want. This is my small level of understanding.
I really don’t believe they are in kahootz with all these Plone sites. If they were, then why not Mambo, Joomla, Xoops, phpNuke, etc…. ?