This could be something as simple as bytecode obfuscation, or something as complex as scraping every bit of personal information available through possibly-questionable means and sending to an insecure server. Copy protection schemes are notoriously user-hostile.
It might be more convenient for google to not say, but it's pretty disrespectful towards clients that choose their platform to make a living and might get caught as a false positive.
If the intent is clearly not malicious and no rules were broken, the reviewer should file a bug report to fix the virus scanner and reinstate the developer account. No further explanation required.
If rules were breached but it may have been done in good faith, issue a warning to the developer and explain in general terms how to fix the problem. Charge a review fee high enough to deter any abuse of the review system.
(this is sarcasm, but from talking to Googler friends over the years, I doubt it's far from the truth)
I mean, we only have the developer's word that they weren't shipping malware in these bytecode files, unless someone reverse engineers it (unlikely), or Google publicly explains the reason for the banning (which they never do).