They don't have to reliably assess whether a plugin is malicious. The checks are a filter so they can apply manual review only to those plugins which pass the

They don't have to reliably assess whether a plugin is malicious. The checks are a filter so they can apply manual review only to those plugins which pass the baseline (and automatable) requirements.