I support plugins for a client that require write access to their homedir that contains their code. They use it to hold temp files!

I can mitigate the damage a little bit with some chattr +i, but overall, every plugin is another gigantic attack surface.