Introspection & Reflection in PHP don't expose everything, and frankly even if they did, it would be quite easy to analyse plugins and have an approved list of "safe" plugins that is used either as an advisory or as a basis for the available plugins shown to a user.