I was being like 99% facetious and the 1% serious has more to do with how eMacs updates are distributed as compared to Notepad++. To your point, any non-vetted packages would be a huge source of risk, and even vetted packages should be monitored.