From what I have heard it wasn't intentionally malicious. Doesn't change the end result tho.
Auditing every submission they get is never happening, there are far to many. However nothing categorised as a theme should be permitted to contain executable code. It is not what people expect and KDE seem to agree there is a disconnect here. https://blog.davidedmundson.co.uk/blog/kde-store-content/
Where as a simple Plasma colour scheme is nothing more than a themename.colors file containing stuff like this:
[Colors:Selection]
BackgroundAlternate=60,120,255
BackgroundNormal=60,120,255
DecorationFocus=60,120,255
DecorationHover=16,166,212
It is read by the system and applied, no execution of commands should be possible here. It just parses key:value pairs if its invalid it will fail. The issue is Global Themes are apparently allowed to pull in more stuff because you may want to change the system menu / calendar etc as one pack and that stuff is executable code.
When it comes to installing plasmoids / widgets / extensions to plasma that is different. I have no objections there. Just like you should not install anything from the AUR you haven't personally reviewed you shouldn't just install a plasmoid from the KDE store without reviewing it either.
