> This is true for any code you install from a third party.

I agree with you that their "discovery" seems obvious, but I think it's slightly worse than third-party code you install locally: You can in principle audit that 3P code line-by-line (or opcode-by-opcode if you didn't build it from source) and control when (if ever) you pull down an update; in contrast, when the code itself is running on someone else's box and your LLM processes its output without any human in between, you lack even that scant assurance.