Obsidian plugin was abused to deploy a remote access trojan 2 months ago
Obsidian does not have auto update for community plugins. The steps for updating them right now is checking for updates and then updating all or individually.
A bad update to one of the popular plugins could compromise lot of systems.