In my experience, the review is only for the first upload. Updates don't seem to be reviewed?
Yeah, seems like they should maybe institute some type of manual review for any type of "global" permissions. It would impede the well-behaving apps that legitimately need global permissions, but it might be worth it.
... or incentive them not to request universe permissions.