The lib.php file in the plugin root has a number of side effects. Typically speaking files should not have side effects in this way. We include lib.php from a wide variety of places and it should not cause any change.
The current lib.php includes a custom configuration file and modifies the global $CFG.
High. Changes of this kind through file inclusion should be avoided.
b3. Proposed solution
Migrating existing content of lib.php to more appropriate locations is already covered in
MDL-70662. The configuration in this file should be removed and converted to standard configuration settings.
Rather than hiding credentials and other configuration in this fashion, appropriate admin settings should be used.