I'd be behind spot-checking at the very least. I feel like Valve is trustworthy enough that most devs should be able to open-source their code to Valve.
If you get caught, you get perma-banned from Steam.
Then put a little thingie showing how many years a dev has existed (so people can put their AI-detector thinking caps on when they see a dev that's existed for 3 months putting out a fully polished game).