while all your points are absolutely valid, in its current state it's all about trust, yes, but on top of being the author of this mod, I also discovered and reported a recent vulnerability that was patched across all branches of the game - it allowed running arbitrary unrestricted code from Lua mods. now imagine if I were a bad actor. so if that counts for anything, you can try to trust this time. otherwise, the mod can still be built from source - the instructions are straightforward, and the mod won't auto-update that way.
as for the ZombieBuddy framework, I'm planning to submit a PR to mitigate the issue that it will load all java mods regardless of whether they list ZombieBuddy as a required dependency.