[3.10] Questions to discuss

### New feature, improvement proposal

The more I look at commit https://github.com/apache/maven/commit/03c947d820889098701021d9a99b256358fde0cd the more questions it raises:
* it removes repositories from profiles. Why? And what happens with repositories defined in POM itself? Why not removing both, why only one (profile)? What differentiates them from POM defined repositories? And IMHO _not removing reposes_ is the proper solution.
* Maven _relies_ on POM defined repositories (they may come from profile), as there is pattern that `project -> dep1 -> dep2` where dep1 _knows_ dep2 is not on Central but is somewhere else.
* What we should scrutinize is _repository redefine_ IMHO, where an existing remote repository was "redefined" (and scoped to that node and below) nb: this reminds me of https://github.com/apache/maven/pull/428
* In case of a "malicious" dependency, that may redefine a repository, it may silently redirect the build to malicious repository?
* In redefine cases we may want to prevent it, or WARN on it, or maybe even have a switch like WARN/FAIL?

Start by reviewing commit 03c947d820889098701021d9a99b256358fde0cd and the related discussion in pull request 428. Trace how profile-defined, POM-defined, and redefined repositories are handled, then document a decided WARN/FAIL/prevention behavior for malicious or redirected repositories; the issue is done only when the project agrees on scope and acceptance criteria.

Written by the indexing model from the issue text.