Not sure that's true for the majority of DAW users.

Plugins are not associated with attack vectors, even though they are literally just that.