Definitely, absolutely.
But make my work, as admin, easier. I, as plugin developer, want to make your work easier.
Currently upgrading puts absolute trust in the source URI. This troubles me, as it has been shown that the source (github) is not trustworthy, especially not in certain steps on a container rebuild. Warn me, as admin, than there is a change in trust relations.
I, as admin, have vetted every plugin or theme component before I added it. After than, Discourse gives me little to no guidance in vetting. Today I needed to rebuild my container, which will re-clone all plugins. I am pretty much out of control, unless I make an advanced change to setup to pin a release.
This might work for me as a well rested software developer the moment I need to do some maintenance. But those are quite some constraints. Besides making Discourse a great platform for discourse. We also need to make it a technically safe platform for discourse. Compromised plugins can do serious damage. Compromised theme components can do significant damage.