Hey Norcross,

When we review themes, we have WP_DEBUG set to true, we use a variation of the Theme-Check plugin and we do some other checks as well. You're right, that won't catch everything, but it's a reasonable start, as are our theme submission guidelines. And we're looking into how we can improve things further.

The main problem is that these have been in place for about a year. Older themes, including Avada, were added before we introduced all of these checks and guidelines. We're looking into how we can apply these to the older themes as well, but it's a huge job. We'll get there eventually.

I will say that if you, or anyone, notices any security issues with a ThemeForest (or CodeCanyon) product, please let me know either through Twitter or stephen dot cronin at envato dot com. We take that seriously.

The ratings are the same as ratings anywhere (including on .org). The people leaving the ratings are mostly just average users who won't know what's going on under the hood. So that's more just a popularity signal from the user perspective.

Personally, I'd love to see a quality signal that informs buyers of a theme's quality. The problem is that going to be really hard to do well (how do we put a score against quality?). It's not worth doing if it can't be done well. So we'll have to see about that, but it's on my radar too.

Cheers,
Stephen