Global themes and widgets created by 3rd party developers for Plasma can and will run arbitrary code, That's how the do what they do. You are encouraged to exercise extreme caution when using these products.
Global themes do not only change the look of Plasma, but also the behavior. To do this they run code, and this code can be faulty, as in the case mentioned above. The code was not malicious, by the way, just wrong. The same goes for widgets and plasmoids.
We are already calling on the community to help us locate and quarantine defective software by using the "Report" buttons available on each item in the KDE Store.
Meanwhile, KDE is taking measures to properly warn users before each download and we are also putting in place ways of auditing and curating what is uploaded to the KDE store.
https://blog.davidedmundson.co.uk/blog/kde-store-content/
Nevertheless, this will take time and resources. We recommend all users to be careful when installing and running software not provided directly by KDE or your distros.
And remember to report any faulty products you find!