> Any web request in my rails app could theoretically add new functions to any other class

Java Spring applications pretty much do the same thing (reflections, proxy beans, aop, JSON/Date serializers/deserializers, ORMs, etc are all compiled and changed dynamically upon route hits).

These things are theoretically possible (and happen) in any JIT language (node, java). Only statically compiled languages seems to be immune to this.