Automate (by Llamalab) is the best example that comes to mind. Tasker also uses plugins, but their "base" app has too many permissions.

A few other applications that use plugins:

* ES File Explorer

* Trigger

* FB Reader

* Threema

And there are others. Most of these don't do this for the explicit purpose of permissions management (Automate may be the only one), but there's no reason that security can't be the primary motivation for a plugin system.

There's another bonus to this approach: a plugin architecture allows you to add controversial features without forcing them on your user base. Don't like a new feature? Don't install it.

Yes, a plugin architecture adds complexity. However, Android's intent system is built to simplify this kind of design, so it's not like you have to build it all from scratch.

I could be wrong, but it seems like none of those apps are really mass marketed to consumers (versus power users). The goal for Signal is to make it something that could gain mass adoption, and requiring users to install plugins in order to do simple things like attach photos would be a serious hinderance there. It's hard enough to convince non-techie friends to install another messenger as it is.

Threema is a direct competitor to Signal.

While I see it as a competitor, I can't see their target markets being the same. Signal, I feel, is targeting average users. Threema's sign up process and verification makes me feel it's for the power user.

I used Threema with my extended family for a while (so not power users). Sign up and (optional!) verification was not a problem. Group management was and ultimately made everybody switch to WhatsApp. Things like "group creator left group, now we must create a new group..." and "identity-only backup means you lose group admin rights".