The expectation is that plugins need to be activated explicitly and that do not get installed or activated automatically. Even stronger, a common impression about plugins is, that they are often a pain to install and get working. I know that this expectation has been violated occasionally in one form or another but I doubt that many people are aware of that or could even come up with examples.
Built-in features on the other hand are completely different. The usual experience is they get moved around, enabled, disabled willy nilly without notification or consent with every (unrelated) update. iTerm2 is not like that and George has done a fantastic job to build a ton of trust over decades, but I don't blame anyone not knowing that and being cautious.
Speaking of attitude, iTerm2 is a gift, and some users (or maybe even non-users) appear to be in need of a reminding.
[*]: Your top level comment
If you are a Mac user and not using (or at least considering) iTerm2, you are doing yourself a disservice. It is by far the best terminal emulator available and runs circles around the built-in option.
If you are a not a Mac user, then the entire discussion is moot either way.
Before it I would recommend kitty or alacritty.
FWIW, they both seem extremely performant and would probably be a great fit if I daily-drove Linux.
It sounds like it's more about the extra features being included than the "batteries". What features does a terminal emulator need other than "lets a user enter stdin and displays stdout/err"?
How so?
I think the root of this issue here is trust and control. I work for a company with a restrictive IT department. It's not "overly-restrictive" because the data with we work with is sensitive. Banning all AI enabled products, which my company did, is absolutely the logical and safe thing to do. (We have self hosted hosted AI solutions and limited GitHub CoPilot access now.)
The AI stuff is disabled by default, the concerns are unfounded.