There is no differentiation between internal/external communities in the plugins. Therefor users can easily place documents in external communities without realizing they do so. Ideally a user should be prompted (popup with OK/CANCEL) when dropping or saving a file in an external community that he is sharing information externally and whether he is aware and ok with that. PReferably with the name of the community.
External communities are a special category of communities as they can cause data leaks an idadvertent data compliance risks. This should be more visible to users.