[johnchristopher]

There's some confusion here. WordPress themes and plug-ins don't rely on the built-in web editor. That's why it can be safely disabled.

What that guy did is no different from sshing into the prod server, live editing a Django plug-in and refreshing the browser.

Version control of the plug-in won't protect from that. But it's a handy tool to manage regressions.

Rolling back changes and editing a live plug-in are different problems.