A simple implementation of Derived Relations and in-line calculations does not require an advanced type system. It’s probably enough that the formula language be pure (no side-effects) and that formulas cannot reference data from other spaces (assuming that data permissions are set at the space, and not the object level).
As for plugins (as requested here here and here), this is where things get more involved, because a plug-in system should facilitate dangerous things such as plug-ins writing into objects (possibly overwriting user data), and communicating with the outside world (which can leak sensitive data if allowed too permissively).
So I suppose we can start with the relatively safe formulas and proceed in parallel to do a careful research and design phase for establishing a security framework for plug-ins.