Did i say malware is being installed? And am i not allowed to hypothesize?

I see the security hole. I imagine some ways it could be abused by an attacker. I admit I am not knowledgable in extension development to make it clear those are hypothesized ideas. Hell theyre even phrased like question? I even agree this is not directly malware and that saying so is a stretch.