The bigger issue here is not telemetry by itself, it's shipping a context-insensitive integration into a tool people use across unrelated repos. If the overhead is real, that turns a convenience plugin into something teams have to actively defend against.

a deployment plugin shipping raw bash command strings off your machine. "actively defend against it" is just normal hygiene