Also: the really nefarious ones wouldn't be detected by the tool from the post, as they demand that the developer account is also transferred with the purchase,

Also: the really nefarious ones wouldn't be detected by the tool from the post, as they demand that the developer account is also transferred with the purchase, not just extension ownership (including the user base) and the code.