In reply to Paul F Gilzow.
Here is how the review that is supposed to be happening when plugins are initially submitted is described:

At that point, someone will manually download and review your code. If we find no issues with the security, documentation, or presentation, your plugin will be approved.

From what we have seen though it seems like there may not be any review, as among other issues, not only do we keep seeing vulnerabilities being included in the initial versions of plugins that should have been caught by even a superficial review, but in one recent instances where there was possibly a vulnerability, when we went to check further into that we found that plugin appeared to be fundamentally broken.

We have offered to work with the team handling those reviews to improve the security review process, but so far they have shown no interest in that.