And when someone creates a project file that sends them the personal information of anyone who opens it, is that an issue? Yes, pervasive arbitrary code plugins are game over if you can get anyone to use your plugin, but there's at least some awareness that you need to be careful opening a plugin you don't trust.
Not sure that's true for the majority of DAW users.
Plugins are not associated with attack vectors, even though they are literally just that.