The WordPress team has thought a lot about this issue, and the most effective solution so far has been to have robust official sources of themes and plugins and educating people to get everything from WordPress.org. (It's the only source built-in to WP software.) It's our equivalent of airplane security's "tougher cabin doors and passenger's willingness to fight back."

An automated scanner in core might temporarily relieve some of the current techniques of spammers but it would be trivial to vary obfuscation to evade any automated check, and I worry more about the false sense of security they would provide. A built-in automated checker would not make it safe for you to Google around random sites and install their software to execute on your server.

On the plus side, we now have over 1,300 themes in our official repository and every single one of them has been verified by hand.