There are many bugs which will not be found by the extras "QA" process, or by Nokia's QA process for OVI. Certainly, intentional bad behaviour can easily slip through. Promising security for extras is akin to selling snake oil. For example. The program can start sending lots of SMS only two weeks after installation.