Comment by AlienRobot

The real problem is people believing "plugins" are not full software.

If you install a dozen mini-apps from random developers you never heard about, you can't complain if one is malware.

Krita also has a plugin system based on Python. Any "plugin" has the same level of access as running a python script.

Personally I blame operating systems for not providing a way to isolate how programs interact with user files.