This would amount to auditing the vast majority of open source code found on the Internet. Not even OpenAI or Anthropic seem quite interested in doing that.
The scope of nixpkgs is nixpkgs. If every package's entire source code was being audited, then there is no such thing as a sustainable repository of software. There simply isn't enough people, or money for AI, to do it.
Alternatively, as SKG suggested, Riot could post the spec needed for a server to communicate with the game, and someone could just write a server for it.
That will also make it entirely unfeasible for anyone to use their services. The cost of the tokens you could burn on a $200 plan is in the neighborhood of $1200. They're getting users now and gambling on the cost of compute (or the difficulty of compute) dropping precipitously before they run out of cash.
For what it's worth with regard to the Chaotic AUR, there's claims I've seen that they do vet packages updates going into it before they're actually built.
As with many things, this is a case of "it depends" - How you do it and for what reason, primarily. If you're reverse engineering code that's part of a DRM scheme for example, that's explicitly not allowed.
Coreboot is debatable for this, it's fine in the sense that nobody is going to come after you for it, but legally you're not doing a clean room implementation, you're looking at the original and creating a new functional replacement, which is fundamentally different to the Phoenix BIOS clone, and not in a good way.
But as I said, nobody is going to come after you for it so...
You say that, but Microsoft has contributed to Wine!
Both in terms of code and help, on occasion. Microsoft gave Mono to Wine, and while Wine has a ban on accepting code from people who have seen the source of Microsoft Windows, they have, if I recall correctly, accepted documentation on Windows Internals from Microsoft themselves.
That's unlikely to happen any time soon, to the best of my knowledge the files between the two are largely different enough to prevent it. The Wii version is a Maybe.
IIRC the difference is the effective requirement of having it for the intended function of the software; To whit: Printing to a Bambu printer. It's a legal gray area but the general legal consensus as I understand it is that the dynamic loading is enough most of the time up to the point where it's a requirement for functionality.
Of course, IANAL and just a random passerby with a SUPER rough understanding.