they are vetted to make sure they don’t contain security vulnerabilities

Not really. There is a basic review when the plugin is first added to the repository, but older plugins and updates to plugins are not reviewed.