Yeah, that matches up with what I've seen. They've at least been decent enough not to kick people off the store, but I don't think it's possible to just have them sign / publish something unlisted these days without a good deal of policy writing and justifications.
Yet the large actors still publish malicious updates to extensions. ¯\_(ツ)_/¯