The proposition I have made in the past is for them to only allow this for established, credible sellers. Those who have proven themselves to be reliable developers. That leaves them the freshmen creators to deal with, and doesn’t bog down the queues. I doubt the scenario you suggest would ever come to be. There is a very tedious process to getting on the marketplace, with some pretty strong barriers to entry. Of the people I have seen among our ranks, I don’t think anyone is going to troll the customer base with infected files.