The WP repository is another layer safeguarding against this. While the humans that review submissions aren't perfect, their review process is intended to find any submissions with malicious code and keep their applications out of the repository. There is greater risk installing an extension that isn't available in the WP repository. That said, I'm very sensitive to security myself and tend to review all .js and .php files that are packaged in any plugin I install in a Wordpress site - even if it's already been reviewed by personnel at WP :)