I think as soon as you add mods to your application that can bring their own code with them you have a potential security issue. The most secure approach that I have seen is wasm mods/plugins run in a sandbox.
As far as I skimmed the text they used bevy for their prototype not for the release or at least not as a whole.
This is a good book to start with small usefull projects in python: https://automatetheboringstuff.com/