Having a review process is too complex given the sheer amount of code committed. Code automation (Checkmarx) may catch some low hanging fruit but in reality it's not a solution and actual code auditing is expensive, time consuming and well..no one likes doing it.

Also a lot of exploits come from bundled scripts (timthumb, jplayer, flash players, etc.) So you are not just liable for a plugins code but a complete 3rd party library ..ya that's not going to happen.

Malware prefers quantity over quality, that's why the top 50 plugins are attacked more often, it's simply a matter of download numbers. In my stats on wpsecure the popularity of plugins are a non-issue exploit wise. Some plugins have under 1k downloads while other have over 1 million.

The reality is that websites are audited and not plugins because no one has truck loads of cash lying around to manually audit and find poc's in hundreds if not thousands of plugins, let alone try and patch them (you can't even patch a plugin using trac..). Where is the return on that investment?

Educate the end- users, no one, including WordPress, is going to hold your hand.

Also I am not particularly interested in any company or person who automates code review, you must provide an actual poc (proof of concept) to be taken seriously.