And didn’t mean to be snarky—but it’s probably a good thing they didn’t just name the plugins in the headline as avoiding them by name isn’t the solution here…

Did you try reading it?

It enables malicious versions of legitimate Obsidian plugins (‘Shell Commands’ and ‘Hider’) that are present in the shared vault.

Note these are deliberately altered versions, not the originals.

That’s true, but neither of those options are POSIX-compliant. You have to set POSIX_ME_SLIMY for clean to also condition.