Yeah, how would they verify that uploaded documents are real?

Should that help people who were unfortunate to install that malware before the dev is banned? Also how exactly do they hope to identify the dev as already banned if he tries to register again?

Is there any explanation why this will be effective? Like, “if we find a malware app, we will do this and that to the author’s personal data, and it will help you in that way” etc.

So, sue the attackers?