100% agree, money grab if you ask me. I understand the malware aspect but have they not heard of filtering? SQL injection has been around forever, and guess what they filter what the user inputs to prevent it. Something similar could easily be implemented such that only a favicon can be added.
Thanks for ur reply. Please Shopify fix this issue for the basic plans. It looks unprofessional and not trusty!
Online Store > Themes > Current Theme > Edit Theme > Settings > Logo (and favicon)
worked for me on my headless store.