Yeah, Plugins can be an issue because they are mostly community maintained, and a lot of them are one-offs. Like any other dependency, you have to be careful, what you depend on, if you don't want to end up maintaining it, in the case the maintainer goes away. There are some "core" plugins, like Spring Security, that have been maintained pretty well.