I dont mean the plugins themselves but the fact that there’s no way to safely download a plugin.

Even if the plugin really is benign, jellyfin will happily download something inauthentic and malicious befuarse there’s no cryptographic signature checks