Great idea, but bad implementation

This plugin was mentioned on WP Tavern and I liked the idea, so I checked out the source code. Choosing to bundle the vulnerabilities with the plugin rather than querying a remote API seems to pretty much defeat the point though.

I described the problem in more detail in a comment on the article. Am I wrong?

I also noticed several poor development practices, like hardcoding the plugin slug instead of using plugins_dir(), duplicating the logic that checks if an installed plugin has a vulnerability instead of modularizing it, and echo’ing large swaths of HTML from inside PHP strings rather than using external view files or simply closing the PHP tag and outputting HTML directly.

https://wordpress.org/plugins/plugin-vulnerabilities/