Very good question. The short answer is that is why I am personally providing free security analysis. I ultimately make that determination. Solidus makes this manageable for me using a combination of a low noise dataset, trusted installer recognition, and reputation scoring. My final determination goes beyond those factors, but they help make the workload manageable at scale.
Or were you asking the question philosophically? Don’t worry. Solidus is not sentient… yet.