As many others already pointed out, making an automatic assessment of reputation is extremely difficult. And that is not all, there is no guarantee that the account owner stays the same. Probably the easiest way to make a reputation system would be account age, capped at 2 years (Else it will get increasingly difficult to remove malicious witnesses in the worst case as well). Now, Justin Sun could just buy 20 accounts (sneaky) of people to do this. Not only that, Steemit Inc probably owns a whole fleet of "old" accounts they could've used for this.

Now, the more complex the reputation system gets the more difficult it will be for an attacker to take over. However, it also gets less democratic with each step. What happens if there is a witness the vast majority disagrees with but due its time on the chain its reputation is too high to remove it from the list of witnesses.