Malleability is a great answer to avoid the death by a thousand feature where you bloat your software because a company asked for something 99% of your users don't care about. That's the path I went with for my open source work with plugins that can run from a wasm runtime to prevent those from doing crazy things [1]. Unsurprisingly plugins represent more than 10x the code than what the core provides.
[1] https://github.com/mickael-kerjean/filestash