This happens frequently and the “are you sure this is a theme” clearly isn’t a good enough prompt since people post here as if there is a problem with the code. Maybe that code should also look for a plugin.rb (or other indicator) and say that it’s a plugin with a link to plugin install instructions.
I think package.json seems like the best test, right? It’s possible to have a plugin that doesn’t have a plugin.rb file (in which case, the plugin should be re-written as a theme component, but that’s another problem).