Plugins on wordpress.org has always been a debateble question for me. According to my opinion all plugins submitted to wordpress.org should be tested thoroughly and should be bug free.
However, I come across many highly used plugins that are not up to scratch. More that 50 percent of plugins I’ve tested have some kind of bug, some are so full of bugs like you can’t believe. A while ago I tested a social plugin for a user that had problems using the plugin, and that sad to say, functions was used in that specific plugin that is depreciated since wordpress v2.0
So it seems that there aren’t any proper control of what goes into the wordpress.org plugin directory and what not.
As for malicious code, I haven’t came across that as of yet. But I’m still very warry of just using a plugin without properly testing it out in a test enviroment. And on that test enviroment I have permanently set debug to true in wp-config.php. Once a plugin has passed in my test site, only then will I install it in my live site