The problem with the current theme/plugin review process is that it only takes place on the initial submission. A malicious individual could submit an innocuous

The problem with the current theme/plugin review process is that it only takes place on the initial submission. A malicious individual could submit an innocuous plugin to the repository and change the code afterwards, which is similar to what happened in this case.