That doesn't sound good at all! I guess they can update themselves automatically. Who vets the plugin ecosystem?