The programmer is a user of said tool in this sense.
If we want an anology to help picture what is going on, the program is a tool, be it a hammer or a nail gun. Speaking from A) experience, B) decent conversations with the developer of SRML, and C) my own CIT course in college, i can say that what the program is doing here in of itself isn't a threat. Will give a more detailed explanation below.
For a few reasons, SRML and UMF are stuck patching data into games in a similar fashion to a number of viruses and other malicious programs, its this method of patching that the computer is detecting as a threat. While definitely a fair concern, the system doesnt read exactly what it is trying to do, and rather the basic processes.
