They definitely wouldn't be if attackers knew that it would then bypass cooldowns!

Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases.