On a more positive note I think a scanner could be an educational tool for developers, for example if they are not using input sanitization (built into wordpress or otherwise) it could warn them, or user role based encapsulation.

It's possible a plugin reviewer could use this but the amount of time and the vastness of the repository is rather daunting without funding.