I'm much, much more willing to do a 15-minute programming test, or even a 60-minute one, than to give a potentially malicious company access to my network. References are for the last stages of the hiring process, once I know I can more or less trust the company.

And from my limited experience on the hiring side, while a trusted referral is worth much more than a programming test, a good report from a potentially adversarially chosen reference is worth much, much less. It's much easier for an unscrupulous person to find a friend who's willing to inflate their achievements on the phone than to provide on-the-spot solutions to programming problems they lack the skill to solve themselves.