If we were really paranoid, we would want to validate the pluginId in the plugins, so we don't include a strange file when looking for the plugin locale file.