Theme and Plug-in source code are secure?

How can we ensure for Theme and Plug-in source code which contributors provide for free is clean without any hack or virus inside original Nop source code?

Any contributed free theme and plugin need approval from nopCommerce team before you can see theme on the list.

It would be nice if the Plugins bin and Plugins content was seperated into folders.

eg. Follow the MVC folder structure, could be something like:
/Plugins/bin/DiscountRules.CustomerRoles           (Nop.Plugin.DiscountRules.HadSpentAmount.dll, ...)
/Plugins/Views/DiscountRules.CustomerRoles      (Configure.cshtml)
/Plugins/Content/DiscountRules.CustomerRoles   (description.txt, logo.jpg)

Applying IIS Hidden Segments to the /Plugins/bin folder would be alot easier.

I'm sure many nopCommerce IIS deployments have overlooked this security and may have left their plugin DLL's exposed to the clients for download!