Inactive plugins can still run code if you access them directly and they do not have any checks preventing this built in.

They are also less likely to be updated, think “I’m not using it, so it doesn’t need to be updated”.