Most premium themes are already available on various websites as pirated versions, and they all are modified to include tons of hidden spam links in footer or header even (at the very least), but some I had a chance to examine (one of my clients got few of them and thought it would be good idea to use them) had many base64 and eval encoded content that (after decoding it) was adding iframes to other website and in one case sending current logged user info to an IP coded inside the malicious content.

GPL is a freedom to distribute, but some things go too far away from simple distribution. Getting the premium theme easy way, pirated, to save few bucks will potentially open a door for all sorts of exploits that less experienced user will not be prepared to deal with, and he will be left with no support since he decided to save some money.

I think that WP.org is scaning all uploaded themes for eval or base64 functions and don't allow that to appear anywhere.