Abilities don’t give a plugin one new attack surface. They give it several, and some belong to other plugins. Which doors are left open depends on whichever filter runs last.