Nothing in security catches "all" things. A review process with a human may be good but it's far from turning humans into infallible detectors. The reputation gained by the App Store is by catching many such apps before they are published, not every single one.