I would argue it happens even inside marketplaces. We've seen the authors of popular Chrome extensions take payouts and sell their extensions to new owners who have bad intentions for the userbase.

Yes, but there used to be a gatekeeping effect because the development of huge software packages like LibreOffice was too capital-intensive to be enticing for a criminal enterprise. If you have malicious intent and know your way around software, finding a security defect and exploiting it for the umpteenth ransomware campaign is much easier than building a full office suite from scratch and getting a userbase going in order to sneak malware in years down the line. The implied fear is that coding chatbots may make this attack economically viable.

Certainly but often there's a company or well-known entity behind popular software, so that brings some accountability to the table.

In this case, these ArtCraft apps are one person I think?