Nearly all distros have this problem when it comes to packaging and distributing 3rd party software.

Even if you're using an immutable distro, your KDE Plasma session can get hijacked if you simply use the built in wizard to install 3rd party desktop widgets, which is a right-click + single-click away on any Plasma destkop.