I don't understand your point. It doesn't matter what the language is: JS, Lua, Python, C++ or even Rust. What matters is the API the extension has access to: tab URLs, web requests, storage, network, DOM read only or read write. Just like in mobile apps: it doesn't matter what language it's written in. It only matters what system apis it has access to.
Why hasn’t the blocker community proposed such yet? It seems like it’s the missing piece: How little scripting capabilities are necessary, etc.
If you had MATCH expressions, CASE statements, and $1/$2/... capturing backreferences, would any of this even be a problem?