Insecure Plugin Design and Excessive Agency