Downvoted for the very obvious:

"In other words, wordpress.org does not scan for malicious code."

If they scanned for malicious code this would not have happened.