Have you tried it though? Because im pretty sure plugins have the same script authority as the command bar
Imagine a malicious plugin that starts to move your cursor at random positions and randomly clicking every second. LocalUserSecurity is only for command bar.