Tickets filed by plugin developers (including requests to publish or update a plugin) are handled by bots. The only contact I've had with a human there has been via backchannels.
Yes, thats also why policies aren’t enforced. I assume OpenAI knew all along that plugins probably are a dead end. Wonder if they will be around 6 months from now.
But Actions will have all the same security challenges basically.