Can't upload because aternos would need to buy an antivirus
Not if they setup their permissions for folder access on the server correctly. If it's done right the plugin's can't access or do anything outside of the server folder. Also there are a lot of free antivirus tools that are good, so they wouldn't necessarily need to buy one