** plugin is click-to-play to reduce resource consumption and risk of zero-day security exploits or
** plugin plays automatically because its popular and considered to be currently safe
* User has an up-to-date version of an "uncommon" plugin or one they have not encountered in the last X days
** plugin is click-to-play to reduce resource consumption and risk of zero-day security exploits or
** plugin plays automatically because its considered safe
* User has a vulnerable plugin with a known security issue, but no update available
** User cannot run plugin or