I said my assumption was that it wasn't their primary responsibility. Again, I'm no developer but I presumed that checking each and every single line of 3rd-party code for both code violations and safety would be unreasonable. Besides - there are (well, were) plenty of warnings for people who know how to read that 3rd-party apps/plugins aren't (well, weren't) IPS's responsibility.
I realise that people who don't pay attention will still message, but I always thought those were easily dismissed (quite frankly, I think a potted email would have done the trick, which I've seen on umpteen million other websites in different contexts). In the end, though, I don't think anything can eliminate the question of vetting - whether Invision did it or a 3rd-party dev does it. Whether there's a Marketplace or not, it comes down to reputation and trust.
And yes, I'd love to know some more (demographic) information about IPS that IPS will never give out. lol