Plugins are the single largest attack surface on any WordPress site you manage. They come from thousands of different developers, at wildly different skill levels, and every one you install is code you are trusting on a client’s site. That trust is exactly what attackers go after.
