Apparently the Omarchy plugin ecosystem is also a free for all like the Arch AUR, except the audience includes people who are new to Linux and less likely to understand the risks.
More generally, how else would a small project allow plugins that isn't "here is a way to add code" and then anyone can release the code they added? Hell, the linux ecosystem in general is a "free for all", and that is the nature of the platform
It's easy enough for Omarchy folks to add "verified" or "trusted" developers down the line.