There's some confusion here. WordPress themes and plug-ins don't rely on the built-in web editor. That's why it can be safely disabled. What that guy did is n

There's some confusion here. WordPress themes and plug-ins don't rely on the built-in web editor. That's why it can be safely disabled. What that guy did is no different from sshing into the prod server, live editing a Django plug-in and refreshing the browser. Version control of the plug-in won't protect from that. But it's a handy tool to manage regressions. Rolling back changes and editing a live plug-in are different problems.