I think that would be OK if he owned management of those files. But alas he is saying he does not -- why would you have those files auto download if you can't guarantee updates are compatible. What happens if the maintainer of those documents updates the structure? What happens when his module gets blacklisted because of a tracking portion (hitting a webserver durring make install).