In the case of plugins, there are only three people on that team I think. And automating security checks is just like automating accessibility checks. You might catch some legitimate things, but for every one legitimate thing, there would be at least five false positives that would have to be checked. So how exactly, given the number of people on the plugins team, who do this in their spare time, does the magic happen that keeps stuff like this from happening again?