Not sure how this is a bug? Since their inception plugins have always automatically executed their scripts. It’s how they initialise and set up all the components needed to work. Sounds more like you want a feature request to prevent this and I can’t see the justification in that if it’s just to resolve an edge case since the option to disable or move plugins exists.
The button gets created by the script when it runs. There will never be a button to press in the first place unless the plugin has already run.
If you want lighter weight plugin loading you can put most of your plugin code in ModuleScripts which only get required once you’ve actually pressed the button that the small bootstrapper script creates (this is the pattern which most of the builtin plugins in Studio use).
Plugins entirely are separate from the place that you’re working on, they’re tied to the developer using them, not the place they’re being used on.
If you mean ability for other developers to see the plugin code if you publish said plugin to the marketplace… they can see the plugin code way regardless of whether it’s in scripts or ModuleScripts. Plugin code isn’t currently protected (other than by the copyright you inherently hold on the plugin code you’ve written)