[DarrenHill]

In therory this could be done with any addon/script/skin no matter where it has come from, its a byproduct of how the whole addon updating system works.
The point regarding trust and 3rd party developers I feel is a little unfair. For 99.999% of 3rd party addon developers, harvesting or screwing around with files is not and will never be on the agenda. Developers, whether 3rd party or in the official repo, create the addons for the exact same reasons.

Indeed it could - my point was more that the official repo submissions are checked to try and ensure that rogue or malicious stuff doesn't get into it, whereas for the other repos (whether added or pre-installed on certain devices) this may well not be the case. If something malicious did get past such a check and into the official repo then there is a case for come-back to Team Kodi, whereas if it happens with an "unofficial" repo (for want of a better way of putting it) then it shouldn't, but probably would anyway due to the common lack of perception of the separation of add-ons and core.

I guess some users may be naive, but i would say a very high proportion of those users know exactly what content "should" or "should not" be available to watch on their tv at home or their phone/tablet whilst out and about.

Agreed, and it's their right to do so if they wish. But it's as long as it's a conscious decision to do so, made with a view to the whole picture of what could be the potential risks and downsides, and not just what media they obviously may wish to receive or access. That users also accept the consequences and responsibility for their action in following that path, and that we're not there to pick up the pieces or accept blame if it does go badly for them nor are we liable for any repercussions or other negative outcomes.

But the amount of people who come here requesting help and support for such add-ons proves that many do not make that distinction or understand fully what they may be getting themselves into. Especially those who buy the "fully loaded" boxes thinking the whole package (in some cases even the hardware) is a "Kodi product" for which we have ultimate responsibility.