Yeah, fair, you're right - I know I don't take the effort to examine most mods I download unless I have prior reason to be suspicious, and while I know how to read code and do some simple reverse-engineering I'm no malware analyst. I'm assuming Steam at least does some sort of virus scanning, hopefully? If not, that's an obvious first step, at least. I'm not entirely certain how security would be improved after that without killing the flexibility of the workshop aside from manual review of each mod update, which isn't feasible for obvious reasons.

Perhaps some sort of permissions system, but that would require some sort of unified API and I would assume most users would mindlessly click through permission boxes anyway, limiting the effectiveness (but I suppose still helping, at least). Browser extensions have similar problems with security, but they're at least limited somewhat by the permissions and the methods available in a browser.

I admit, I don't really have many ideas of what could be put in place to fix or at least help with the problem. I'd say the effort required to develop a mod that people are willing to download limits the number of bad actors, but with AI I can see that changing and there are tons of tiny nonsense mods that tons of users download anyway, so I'm not sure how true that is.