I can’t find it now, but I read that the verification process also includes human review (for the initial verification, not every update), so it should actually prevent “verified” malware (though it does nothing against unverified malware).

Edit: Here’s an article with this and more info: https://lwn.net/SubscriberLink/966187/3ef48792e5e8c71d/