This is quite legit and true, but who would do that? Who would bell the cat? It's an interesting proposition, in fact Rugdoc, a DeFi auditing upshoot does that exactly, but even at that not all projects comply, and its not even sureproof of hiccups as we can see from the EvoBridge/Valleyswap issue