Speaking as someone who has been building a business around an Obsidian plugin - I think you're on the right track.

What actually matters is that the plugin developer is pro-social, discloses the behavior, the user accepts that disclosure, and that the user isn't duped by their inability to review all of the code for every update.