The plugin indeed changes the bytecode of your app in several places. It looks for certain patterns to identify where the changes are needed. However, it never sends your source code nor the bytecode to anywhere and all changes are made strictly to inject the OTA feature.
Honestly, any plugin you add to your project can access your source code, resources and bytecode and our plugin is no different from Firebase or Google Services in term how it changes your bytecode.
We are ready to sign a contract binding us to not send your source code, resources or bytecode anywhere and inject only code strictly needed for OTA features.
The second option is to use our CLI, but you will lose the comfort of the automatic resolution of your project structure and OTA updates.
Please help us with improving our documentation.
We appreciate all your feedback.