Plugins on KSP are unmanaged (and potentially malicious) code. KSP doesn't have an API, it just leaves a bunch of stuff publically accessible. The game does ABSOLUTELY NOTHING to stop a plugin from doing what it likes. If I REALLY wanted to (and you were stupid enough to give KSP administrator rights) I could wipe your entire hard drive.