The lack of any real screening in the plugins directory is WordPress's single biggest security gap. Anyone who has a plugin on there knows how easy it would be to add malicious code.

The lack of oversight is somewhat baffling to me. Our community is this big, the plugins directory is this active, and all we have are a couple volunteers maintaining it?

You would think Automattic would be willing to lend some resources. It's certainly in their interest to make sure WordPress doesn't develop more of a reputation for having security issues.

Meanwhile the theme review team has become incredibly strigent over the past few years. Why can't the same be true for plugins? There is a ton of cruft in there currently. A little more oversight would lead to slower updates and heavier curation but I think that's a tradeoff most people would welcome.