The code sniffer is a good tool for developers in helping them write better code. It's not meant for users.

After using the PHPCS WPCS project for months to review code, I can say with absolute certainty that there are far too many false-positives given. That's not a problem in terms of using the tool. It simply means, "Hey, you need to check that this is OK; it may or may not be an issue." It doesn't necessarily mean, "Hey, this is broken."

The code sniffer results should never be used as a metric for end users. Certainly not based on a 5-star rating system. It'd be far too easy to write a quality, secure 1-star plugin that gets matched up against an insecure 5-star plugin.

I can't speak to the other two scans mentioned. I'm only familiar with PHPCS WPCS.