This feels like the same kind of issue as Google and Meta have with their advertising platforms:
They don't know what they're facilitating.
Which, in my opinion, means that their workflow is flawed and regulation is needed to prevent private companies from shirking responsibility for promoting malware to the general public.
If they own the platform (be it advertising or marketplace) it should be curated such that the platform's brand is at risk if bad actors are allowed on it.
They've been so proud of their ability to scale, but it's only "worked" because they avoided a lot of the hard problems, flushing essentially their waste products into the internet. Without punishment.
