I agree there's a tension.

There are strong engineering impetuses for control, for provability, for ahead-of-time decisions, for immutability. Engineers get woken up when things go wrong, they get blamed when things go wrong, & they want, they have to deal with other engineers code doing bad things with their code, & the software world has a wide variety of strategies, tools, & outlooks that all try to build safety, certainty, that restrict & constrain systems, to keep anything unexpected from happening.

I feel, though, that characterizing malleable systems as being for expert users alone is a great injury. At present this may match expectations, but I don't think it's fair to make an assessment of how or what computer-users want when, at the moment, they don't really have the options. There are too few malleable systems out there to judge. What general malleable systems we do have require advanced expertise to use- AppleScript, DCOP (Desktop COmmunication Protocol), DBus, WebExtensions all require at least some programming style skills to use. But I think this expertise is owing to a broad lack of investment in building malleable software. Most software strives to give the user a specified & specific experience, not be a malleable system folks can get the experience they want out of. I don't think we know how much latent pull users have, how strong the tension is to be released from engineer's certainty, because I don't think there are even many testbeds, much less a broader societal view of systems flexibility, systems adaptability, of softer software.

To me, I just think it's clear that, whatever valid concerns we do have, whatever justification we have for building endless arrays of rigid systems, it seems like it's not worth it anymore. We keep making more and more software, the profusion of software applications is a torrent of similar-but-different applications, focusing on shuffling this or that kind of data specifically, yet the generality, the inter-connectedness of the pieces seems so weak, and it seems like we've shut users out from having any creative capabilities & control of their own.

I think WebExtensions are a very interesting case. The killer aspect, to me, is that the extensions work invisibly. We can't rely on everyone becoming an expert extension operator, but I do think that some reporting mechanisms on what extensions do would radically reshape how the community review's & socialized the extensions they use. In many ways, it's that the extensions are a means of exercising the malleability of hypertext, but they themselves are rigid & unmalleable & opaque. A part of being malleable- a precondition- is making yourself visible, providing viewability into what is happening, such that folks can reshape & redefine & redirect those actions that you the software are enacting. So the circle needs to grow more, is what it seems to me- rather than lock down extensions, rather than rely on authoritarian centralized powers to moderate extensions, my plea would be to make extensions malleable too, to make their working visible too, and to try to let consciousness & human adaptability start to take hold in this realm.

You're absolutely correct that there are good reasons why software is so rigid & inflexible & opaque. Security has been nightmarishly cumbersome to the whole industry for the last decade. And I think malleability does indeed open up a lot more surfaces, endlessly opens surfaces. But at some point, we have to develop systems that have a co-relation with their operators, that respect the operators, that let them see what is happening & let them work their own systems. Continuing to try to push computers forwards entirely on the assumption that the user is worthless, does not know anything, and can not understand what is happening has cornered us, has cut off the chance to try & explore other options.