The thing that wordpress COULD do, is give some kind of advance notice about what is in the plugin you are installing. Far too many themes contain obfuscated code with horrid little advertising links, and people install these, blissfully unaware of their payload. Similarly, if the theme is installing extra php code, like timthumb.php, then it is surely worthwhile to tell the world.