In reply to Trevor.

@trevor, think about your windows machine (or about some unlucky guy like me using one ;) ) Once you have installed some software as root, it has the capability to hide itself from any anti virus scan, and to root itself so hard in the OS, nothing less of a format will be enough to take it out.

At WP once something is on your server, it might be an attack vector even if it was not activated as a plugin, and once it is active, it can suppress all notifications. You can not check the plugin at activation because the plugins code already runs then, and it is actually very easy to write a plugin with a back door that will comply with whatever coding standard you want.

(I assume that Otto here means that by distributing the check code you are exposing the coding standard and helping the bad guys test their malware against it. If it is so then it smell like security by obscurity which has its merits, but usually is considered a bad idea).

To have a proper security against something you have already installed on your machine, you need the OS to supply facilities against it, because usually applications can not obstruct the way the OS works. If you heard about "secure boot" this is one effort in that direction.
The equivalent in wordpress would be for PHP to provide such facilities, and as long as it doesn't there is very little little you can do.

Modern OS like IOS and android do not AFAICT even try to detect malware on the machine and rely on off machine security related acceptance testing.
Wordpress here actually follow industry standard and I assume that if apple and google did not find a way to detect malware after it is installed, it will be unrealistic to expect Otto and the small group of people helping him to come up with a better scheme.

It is not like nothing can be done at all, but engineering a system in which plugins do not "run" as root and therefor can be monitored by wordpress core is very far from being trivial, and will probably require changes in most plugins in addition to the changes done in core.