I'm sure they'd all say their code is publicly available, that they use the strongest security on their Google account and that they would never sell their plugins to anyone without plenty of notice to all users. As you imply, we are each responsible for who and what we trust