You'll notice
Useful3 Signal2
Bulk and background plugin updates skip command-installed plugins so nothing runs unattended.
What's wrong with this entry?
Anonymous. No account, no email.
What
Updating all plugins now skips any plugin whose install method is a marketplace-declared command and tells you why, pointing you at its details view to review the command first. Automatic background updates pass the same skip, so an unattended update never runs a command on your machine.
Evidence
installed by running a command on this machine — open its details (Enter) to review the command and install it from there
Strings lifted out of the shipped bundle, so the claim above can be checked against them.