Figma has actually gone along this line of thinking for plugins since ~2019 https://www.figma.com/blog/an-update-on-plugin-security/ albeit their choice was from securing the existing plugin model rather than providing a minimal new scripting system.