They could have just added it as a flag to plugins, showing a clear security warning, potentially requiring a review.