I think it's amazing that #Obsidian defaults to vendoring all plugins into my Vault and letting the user control when and what to update, but the fact that basically every extension publishes obfuscated code means that you simply cannot review the changes even though they technically live in your Vault as "plain" JavaScript.