Emacs and Magit

This seems to be similar problem to the one with applications and bundled libraries. The user might want to use different (combination) of libraries or extensions than the distributor expects (and supports). What if there's a (big scary) security hole in magit?