In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of the plugin, there will be at least 2 or 3 additional tabs. debugging information, advertising, promotional offers, 3rd party content, and so on.
All of the contents of these tabs are in direct contact with the developer servers. loaded in frames, scripts, trackers, sniffers. Updated in real time. Some of these scripts are loaded from their partners servers, 3rd party.
Once you open that additional tab, all the information from your current admin session will be available to anyone. Clicking on any link can be even worse.
Magento constantly releases patches, fixing remote code execution, privileges escalation, injections, etc
Many shops have 50+ of different extensions loaded with additional garbage.
so the questions are:
Why the extension developers load all this nonsense into the admin backend, not letting me know about it and without my consent? No way to disable or remove this crap. Do they understand the consequences and take responsibility for the security of information?
Why doesn't Magento prohibit loading all these which does not apply to extension settings? As a general rule, Magento partners must follow basic security rules?