Thanks for the practical answer. And, therefore it becomes futile to protect the package from being edited by a third party (beyong config changes).