It's a hard problem as many extensions do the equivalent of loading in a script from a remote site as part of their start -up process (consider an adblocker that regularly pulls down and updates list of ad definitions).

You could imagine that a malicious company would put through a "clean" version for testing and then once approved swap the script for the one loading malware.