This is a valid concern imo, but I'm not too afraid about nvim itself being compromised. I do think it is risky to be depending on many plugins, which is why I'm hoping nvim can integrate more of the popular plugins into nvim proper.