I think you are operating under the assumption that are plugins are/must be free and/or open-source. That is not the case.
There are (a few) plugins which are closed source and /or need a payment.
Plugins published in Obsidian must have a license (whatever they pick). So maybe this is an old plugin before we had this rule in place or before we had automatic checks. Nevertheless, you can DM @joethei info about the specific plugin and he’ll verify.