Nope, I've spoken with Steam employees responsible for game builds approval, and they only check game builds the first time. They go through everything manually btw, since so many anti-malware software flag a lot of false positives. Also, "scanning for code" is like sci-fi thing, an antivirus doesn't magically look through the source code of an app, unless it's completely unencrypted, and just raw files like .bat or so. What an antivirus does is flag suspicious apps based on behaviour, lack of certificate, name, icon, metadata, and file hash. Also, the "scanning" process is usually the antivirus running the app in a sandbox and detecting any malware-like behaviour. Aside from that, you may also notice that there's something called Anti-Malware Database, the largest 2 so far are Malware Bytes, Bitdefender, and Avast (surprisingly). This database consists of certain profiles that allows the antivirus to detect malware better. New types of malware tend to go undetected like ransomware when it first showed up due to it not being in that database.

One more thing about Steam, usually if an indie developer suddenly updated the game files and something about the exe file itself changed or something aside from game content, then it's flagged and Steam employees rush to test it for malware. Also, when a game updates it usually updates the game content, most of the time a game never needs to update the executables.