Plugin architecture for SaaS extensibility: lessons learned?

we're in the early stages of designing a plugin architecture for our b2b saas platform, similar to how shopify or figma allow extensions. the goal is to let customers or partners build custom logic that runs within our ecosystem. we're exploring options like webassembly for sandboxed execution of user-supplied code, using webhooks to notify plugins of events, and providing a clean rest api for data access. a big focus is on developer experience for the plugin authors: clear apis, good documentation, and debugging tools. for those who've built and scaled successful plugin systems, what were your biggest lessons learned, especially regarding security, performance isolation, and the developer experience for external parties?