It really is true that scanners of this nature have been around for decades. There are many Patents pertaining to this Art. Indeed, the art has been known & patented for so long, so many times, that patents have for years been expiring, allowing others to then roll formerly-protected art into modified products, and then patenting the 'new' art.

The limitations & foibles of these scanners became well-known, decades ago. Most ongoing art involves attempts to dodge/hide these essential shortcomings.

If scanners could actually do what is claimed for them, there would be no vulnerabilities. Anywhere. The phenomena of errors & oversights & weaknesses would be simply extinct.
=====

Notice that Checkmarx studied the most-popular plugins, and found lots of issues ... they did not study dorky plugins, but we tacitly assume - without even looking - that dorkware would be even worse. On this partial finding, we then tend to ask: "Shouldn't we make standards that all plugin authors have to meet, and establish vetting to ensure these codes are up to snuff"?

Accomplished programmers would have no problem, getting over a steeper learning-curve and a higher barrier-to-entry. But casual authors and their to-diss plugins would be excluded, rejected and culled, in large numbers.

For some, getting rid of the low-skill authors & their plugins would be acceptable. "Hey - we gotta clean this mess up"! For others, it would even be desirable; a way to 'deal with' unwanted competition.

But the bottom line on crudnik coders & plugins is ... WordPress themselves are obviously protecting the plugin-rabble; has been for years, and show no signs of changing that policy. Any plugin-enhancement solution that incidentally grinds the plugin riff-raff under the wheels of Progress will be unacceptable to WordPress.

Any suggestions for addressing issues with plugins must make-nice with plugin-hillbillies.

It is a matter of top strategic importance, that Honey Boo-Boo herself can take a glance at the plugin-scene and snort; "Fiddle. Even I can do that".

Plugin-management ideas cannot reject -- or even noticeably inconvenience -- the inexpert. WordPress HQ won't have it.