There are no measures in place to avoid a plugin being uploaded with the debug flag being enabled in plugin.json. It should either be removed automatically before uploading or not be uploaded at all.