The post literally does that. it talks about how plugin access to core is handled. So to be explicit: if you don't see that as a very significant security improvement over WP's open world, then it may help to understand why. The post also talks about WP ecosystem downside due to this.

  | "network:fetch" // ctx.http is available (host-restricted via allowedHosts)
  | "network:fetch:any" // ctx.http is available (unrestricted outbound —   use for user-configured URLs)
  | "read:content" // ctx.content.get/list available
  | "write:content" // ctx.content.create/update/delete available
  | "read:media" // ctx.media.get/list available
  | "write:media" // ctx.media.getUploadUrl/delete available
  | "read:users" // ctx.users is available
  | "email:send" // ctx.email is available (when a provider is configured)
  | "email:provide" // can register email:deliver exclusive hook (transport provider)
  | "email:intercept" // can register email:beforeSend / email:afterSend hooks
  | "page:inject"; // can register page:fragments hook (inject scripts/styles into pages)

That are the plugin capabilities. I have no clue how it could replace any serious WP plugin. Of course it's secure ;)

> I have no clue how it could replace any serious WP plugin.

I'll repeat: your knowledge of security has a gap. You can specifically look up on "Principle of least privilege" as is widely used in apps and browsers too.