In reply to Peter La Fond.

Although themes are reviewed by a review team before being added to the theme directory, themes on wordpress.org are not sucuri audited. Therefore, you must really trust the theme's author before downloading and installing one. Avada has't gone through this baseline process.

Theme Review Team page...
https://make.wordpress.org/themes/handbook/review/required/

And don't be trying to fool others; Sucuri theme audits do catch vulnerabilities. Many of the top theme and plugin manufacturers have Sucuri audit their products. These brands include WooThemes and WooCommerce, ElegantThemes and Yoast ...just off the top of my head. All top-selling themes manufacturers should be having 3rd-party security audits performed on their products. It's irresponsible to not be doing it.