We've talked about this a lot during early actor days, and currently the answer really might be to use distributed actor + process isolation.
There's recent thread about this: Runtime extensibility via distributed actors, as well as a demo here: GitHub - martiall/swift-subprocess-distributedactors, using just pipes and how one could even run the "other side" in wasm etc.
Using this, you can crash the whole "other side" because it's properly process isolated. It comes at a cost though, the process.
Either way, it's a worthwhile idea to build out and I'd love to form a workgroup of some kind to pursue these ideas.