It is certainly a bug I guess a simple fix is to ensure the plugin always comes from discourse org in github to be marked official
Technically though you could still cheat quite easily
Searching that a specific sha is our sha would be the only 100% accurate way, but that would require we stand up another service
Imo I would put this in the, something to fix over the next 2-3 years bucket