The plugin is given a person and told that this person either gets to login, or doesn't. The plugins are designed not to need any knowledge of which queries guarantee the permission, just that this record needs it.
So, what exactly is the plugin doing again that a class doesn't?
My criteria for good software:
Does it work?
Can someone else come in, make a change, and be reasonably certain no bugs were introduced?