You assume correct, that is one of the methods we are using.

We also look for signatures in the code that certain plugins output. For example Yoast SEO usually adds a HTML comment at the end of the page identifying itself.