It is fairly simple to check for obviously malicious JS or PHP code in a theme, but it's not so easy to find themes which are badly written and thus insecure. Can you always spot a XSS or SQL injection vulnerability?