Is Netplan acting like hidden malware?

[bushw]

Armbian uses Netplan by default to manage network settings. But when it uses  NetworkManager as renderer, it silently changes iptables rules—without asking, without telling.

 

*Neither Netplan nor NetworkManager are supposed to manage firewall settings.*

 

But they do it anyway, behind the scenes. That kind of behavior—making security changes without user consent—feels a lot like what malware does.