Fix Version/s: 3.0 beta 1
TL;DR this ticket is about to add an other config option to enable scripted UDFs.
Securing Java-UDFs is much easier than scripted UDFs.
The secure execution of scripted UDFs heavily relies on "how secure" a particular script provider implementation is. Nashorn is probably pretty good at this - but (as discussed offline with [~iamaleksey]) we are not certain. This becomes worse with other JSR-223 providers (which need to be installed by the user anyway).
TBH: I would feel more comfortable to have this one. But we should review this along with enable_user_defined_functions for 4.0.