Rights protection bypass in some plugins

In some plugins (at least LDAPPlugin and FeedsPlugin) there is rights check in the PluginAPI but no rights check in the getPlugin() function.
So anyone will be able to use plugin's fonctions directly, bypassing de PluginAPI checks.
A fix could be to put rights checks in the getPlugin() function or directly inside plugins.
But I think the best choice would be to remove the getPlugin() from the PluginAPI, as it's shouldn't be allowed calling plugins directly from a groovy or velocity page.
WDYT?