The Apache Attic exists for products that have been released by the ASF but for which there is no longer a community capable of making decisions like "do we release a fix to this security issue". contrib stuff does not need to go to the Attic -- it can just be svn removed, or svn moved to something like a "sandbox" area that doesn't get released.
....Roy
