BlueHost says The Plugin is Malicious

Is this part of the plugin or was my copy compromised?

This notice is to inform you that we have detected malicious code in your website files. We have compiled a list of compromised files on your account, as well as the code injected, below.

In order to maintain a secure hosting environment, we will be automatically correcting these compromised files on your account; however, please be aware that you are responsible for verifying that the content hosted within your account is secure. We strongly advise that you update your installed scripts and software, as outdated scripts and software are the most frequently used method for accessing and gaining control of a targeted account.

If you need assistance updating the software on your hosting account, please do not hesitate to contact our Support department.

The compromised files detected are:

/wp-content/plugins/follow-button-for-jetpack/bao.php

The malicious code detected is similar to:

Files with the following contents or MD5SUMs, which contain malicious code:

\$default_action\s*=\s*[‘”]FilesMan[‘”]\s*

This time they went easy and “corrected it” whatever that means. In the past they have shut down every site on my hosting account after “detecting malicious code”. Are they just finding things which don’t matter or are these threats real?

https://www.ads-software.com/plugins/follow-button-for-jetpack/