“Global Themes” in Plasma do more than just styling
To developers it’s not a surprise that third party plugins can do this sort of thing. It’s as intended. A global theme can ship custom lockscreens, custom applets, custom settings and all of these can run arbitrary bundled code. You can’t constrain this without limiting functionality.
Naturally this is not what an end user expects when browsing for themes, and the warnings don’t make up for the risks.
I hope devs can find a better way to ship this rich functionality, or at least introduce an automated “canary-release” process to the KDE Store that takes down themes that misbehave.