Most BeamNG mods don't even have any lua file in them. Even with lua, the mod is still very unlike an exe. Treat it like an exe will lead to unnecessary anxiety/panic that might cause sanity slippage. As of 12 November 2021, ten years after BeamNG.drive's initial release, there is still zero known "jumps the sandbox" case caused by third-party mods. OT: 2fastmeshslapping and revolutionslapcraft are as bad as third-party ad flooded mod sites. At the end of the day, this is just my opinion. People have the freedom to treat the mod zip as anything they like. This is not cost-efficient, naming a virus hotgirls.zip.exe or [insert most begged mod name here].zip.exe while hiding the .exe file extension is much more cost efficient for attackers than figuring out how to use BeamNG mod lua attack.