hmmm... haven't thought of that, that's an interesting point.

Yeah it occured to me when i realized i need VMF for hooking existing functions for the photomode.

As I understand it, VMF would be sanctioned because it makes no changes to gameplay and shouldn't have any impact on the experiences of unmodded players by itself. It doesn't have a method to arbitrarily load untrusted code, so the mods dependent on it can be reviewed independently.

It might be a little more complicated to review a VMF mod because of the in-built framework functions it'll be using, but I think the function names are clear enough to judge how they're used.