The obsidian vault is to already have the chosen plugin pre-selected and is part of the social engineering effort, that's not the main problem.

The issue is that this could happen to anyone who just searches the malicious plugin's name and installs it. Worse if it's a popular one that gets compromised.