A plugin service can be a TCP socket now, so it does not make much sense to strictly check for CAP_CHOWN.