In the context of an editor, this can be bypassed by writing this kind of code to the project, which will be run when the developer runs the project, runs tests, or in some languages even when the project is compiled.

A theme probably doesn't need access to the project files, but many extensions do. This is much harder to solve than in e.g. Android.