>Well, in fact, nobody will do it. You're stating this in absolute terms but the reality is not black and white. If it was possible to review the code that act

>Well, in fact, nobody will do it. You're stating this in absolute terms but the reality is not black and white. If it was possible to review the code that actually gets deployed, then it would depend on a project's popularity how many people would be willing to take a look at the source code. I might do it myself if I relied on it for something like a password manager. The intransparency introduced by the app store makes it impossible for anyone to look at the code. Any publisher of malware can be 100% certain that no one will look at their code. It's sort of the inverse of the chilling effect. And when a suspicion arises there's no way of finding out the truth about what actually happened and you have no way of knowing what to protect against.