Unwanted additions to functions.php break themes

I got the malicious theme here:

https://www.themes2wp.com/download-free-a-free-worpress-theme-feeding-wordpress-theme

The theme seems to be removed now, great!
But I wonder why it is so silent around this topic, isn’t that a major security issue, that themes can do that, and not just any theme, but themes that are advertised here too?

All themes submitted or updated since June 2010 undergo a review that now includes an automated check for any suspicious code but, as you might imagine, this can be an ongoing battle with the checks trying to keep pace with the spammers etc. However, it’s not uncommon for less reputable sites to download themes from www.ads-software.com, add their own (often very dubious) code and then offer these altered themes for download.

https://www.ads-software.com/extend/themes/ still remains the best and safest place to download themes from.

Thx esmi for your reaction..!

I found one of the infected files here https://themes.svn.www.ads-software.com/simply-works-core/1.2/functions.php but the theme itself is not infected anymore, probably these where some old files.

Very nice that you’re holding a cleanup!

But is there no way to restrict a theme to it’s own directory? Because this way every installed theme is a risk, even if installed from wordpress site.

Cheers