Not just algorithms for automatic approving, malware detection should be given as better, manually checking the codes should be strict, since it's required when you as a developer trying to list your app in PS for first version upload and in every update. Although they are more strict now than before but still got bypassed by malicious actors/users.
It's first time I'm hearing that, is it strange that all programmers need to share their code to Google in order to get their application listed on their store? Are you sure about what you said? I mean highly reputed vendors may hesitate to share their code to Google or anyone else because sharing of that code may allow others to easily make similar applications with less effort.
Since you said that then I guess in that case malware developers might share fake code first which's free from malware and when they compile the application then they may include the malware in it. Google might think that the applications source code was free from malware and the actual compiled APK might also be free from all such malware.
