I 95% agree with that. And now we’re talking about Discourse, imagine we would be in the Wordpress world!
(The lacking 5%: I don’t think it’s the “wild west” - security issues are being reported through meta to those third party developers and in general they’re being fixed pretty quickly).
But at the same time my experience is that LLMs (nowadays) generate more secure code than the average human plugin author. And you can throw a plugin at any decent LLM and ask it “find and fix any security issues” and it will do it, even if the human does not have much security knowledge.
I’ve been manually reviewing plugins for the last decade and I’ve seen a lot: SQL injections (by people who thought ActiveRecord was too fancy), API key settings having client: true, complete lack of authorisation and access controls, lack of rate limiting. They’re all found and fixed by LLMs in no time and without too much of an effort.
So again: I think LLMs made this better, not worse.
You’re still associating LLM generated code with a “can of worms”, that’s too black and white.