Theoretically in an Electron app, you could run plugins in a separate v8 context without the node native FS libraries available. Short of OS-level sandboxing that's probably the best they could do.

Like what cloudflare does in EmDash (the spiritual successor to WordPress).

But almost all plugins would need to be rewritten?