[gerv]

Because bad guys can just keep getting new certs when their old ones are revoked, unless you do identity validation (which costs money as it requires actual humans, so the certs can't be cheap or free).

[schrodinger]

Reviewing plugins costs somewhere around the same amount of human time/money, no?

[malka]

If their review are as thorough as Android app's one, they cost about nothing.

[reubenmorais]

Add-on reviews are done largely by volunteers.

[soapdog]

the addons signage is an automated process.