I think of charities like Etsy shops.

Their primary business is not keeping recordings and publishing neatly organized transparency records. Because (a) it's not what the people working for them are interested in, (b) they're heavily volunteer supported, & (c) they don't / can't spend the money to hire someone to do that work.

In the same way someone on Etsy wants to make jewelry, not run a C-corp.

End result... good charities look a lot like bad charities, with limited ability for bystanders to distinguish. In fact, possibly negatively, as actively malicious charities can spend time and money optimizing for externally visible attributes.

The solution is, as you noted, to lean on someone who does have the time to externally audit various charities.