I suggest that the gulf between perfect foolproof detection and what Google actually does now is vast. They can start by banning remote code, and follow up by setting up automated flagging with manual review for popular extensions to start with. Just getting clarification from developers regarding anything suspicious would be great.