players can use admin commands(debug and noclip) when "ddraw.arrow" is showing 

Unfortuntely that handling is necessary for the arrow to show, but the player would only have access while the flag is set; which it's immediately unset after drawing the arrow. This would be the same for any plugin that does this for commands restricted to admin.

It would depend on the frequency that the plugin is running UpdateDraw, as the player can only do it when the flag is set to true. If the method is ran rapidly, then the player can abuse it easily vs. it only being set for a split second once.

To add onto this bug for those who may not be aware...This also allows them access to the XPerience plugin's admin panel, meaning players can take control of your XPStats settings and change them to however they feel fit. If you are using this plugin and have XPerience, I'd consider not, using Pets for now. :(

This is only occurring using the draw mode.