They really need to force all plugins to pass the VIP phpcs rules (would need to be modified a bit). It wouldn’t be perfect but I bet it would greatly increase security. I’d also like to see them switch to git for the plugin repos.
Could you explain this idea some more? It doesn't seem related to your first suggestion.
Some people just use the svn plugin repos as a release system, the actual development being done in git. There are even github actions to automate it.