Ok fair enough. It is always a concern.
But how do you solve getting the plugin, if the person has no idea how to.
It seems there has to be at least some “trust” if the person does not know github or where to get the plugin, after all they just wanted to visit the SAFE site