Someone will need to, yes. Hopefully it would be a more centralized, trusted auditor.

But flip it around -- without such audits (the status quo), you don't know what code runs in your own codebase. Is that acceptable?