Except that in this case, it's misplaced, and causing benign actors far more pain than malicious actors. If they want to hurt malicious developers, they need to flag extensions as untrustworthy for:

1. age < 180 days

2. dau < 1000

3. some rule around user reports of malice on uninstall?

and this gets a bright warning banner on the top of the page, and it can't be discovered through the chrome store until crossing these thresholds.