I was on that 24 hour clock thinking. Am I wrong to think that this will not stop every malicious update? For example, someone pushes a bad update, it sits in the 24 hours and nobody looks at it in time. Then it auto-updates anyway and the attacker goes: "hehehe I added something really fun to my plugin 🙂". So the time period alone doesn't solve the issue.
Or. A scanner checks the update, says there's no problems. It goes out to uses and no one's home when hackers go "BOOM!!"
So the real question here is whether 24 hours is long enough for a scanner or a reviewer to actually flag a malicious update?
I would love to hear opinions from others.
