To close the loop on this - note snapd-control is a super-privileged interface and so any snap requiring this needs to have publisher vetting. However, in this case plasma-discover is published by the KDE Verified Accounts and so is already vetted/verified.