Comment by Hackbraten

Except that exhaustively scanning for badness is provably impossible.

It's inevitable that a false negative will slip through one day, and when that happens, it will compromise everyone who installs it, no matter if on day one or day eight.