Heh, bet yer blogroll is skimming links off to some dick
A.) Bad guys offer a lot of cool stuff for free, just to spread their attacks
B.) These attacks don't just target you, but your site's visitors
C.) When you add a plugin or theme via WP-Admin (rather than FTP), you may indeed be handing your server and database credentials (username / password) to the bad guys
Some Chinese bastards compromised my site that way and it took Google to tell me
