In reply to Nikolay.

Did that every actually happen to you, and did you tell the plugins team?

For the extremely few times I know of, we rolled back the plugin code, eliminated the malicious author entirely, and ended the plugin. Not very often, and I've been doing this full time for 10 years now. I feel that your memory is long here, because that is a rare event.