You’ll need to define the security framework and building blocks that all plugins may need, which takes time to design, implement, verify and maintain.

Much easier to just skip that part.

So yes, it’s too much work (in the sense that you need to have a security-focused leadership that understands that this is a lot of work but the right thing to do).