Are there any general recommendations for how to design the security posture for a program in respect to any 3rd party plugins you might allow the user to download?

Like, yeah, if a user downloads a plugin, they can now run arbitrary code within the program, and potentially do some harm. Should I just not fight it and hand the nuclear codes to the plugins, or should I be actually planning to somehow isolate the plugin from being able to do anything too ambitious?

Like, specifically we're talking about unvetted plugins, inside of a terminal-based app like maybe a web browser or something like that.