Definitely a policy blind-spot. We need to mark all our plugin functions `@private` I guess and try to figure out if any of them were likely to be used by other plugins.