Plugins should have permissions on their own. The permissions are merged with the logged in user's permissions to create a new permission set. This could be used to give users extended rights through a plugin. Ie. a user may not have permission to upload files, but we want the user to be able to run an analysis plugin that create files. To make this possible we must give the plugin in question permission to create files.