Exactly. A plug-in architecture is a feature, and it’s really hard to secure. Instead of going that route, they should have instead solved specific problems. When you make it easy to add someone else’s code, you also make it easy to forget to remove it later, or to not stay updated on which plugins are deprecated/abandoned.
A plug-in system is insecure by design for a public-facing service. YAGNI, so pick a handful of stuff you actually need.
