To review these third-party mods one needs to understand C++, Windows programming, and fairly obscure theming-related parts of its internals, some of which are undocumented/reverse engineered, and many have poorly understood side effects. This is a pretty specific combination of skills that slowly approaches arcane status, even if might feel otherwise to some. But again, larger apps are indeed harder to review than this.

(this particular mod is 100% innocuous, though)

Huh, with AI you can always "review" those mods. They are small enough. Anyway they are distributed via the creator's github repo, so it's already somewhat of a peer reviewed mechanism.

No disrespect but Windhawk’s process injection loader code was cut and paste from malware source code. I can’t imagine how many AV/EDR alerts that project has generated from using ROR API hashing and PEB symbol traversing.