If we did this, it just needs a way to be moderated. You can do a lot of very harmful things just from one lua script, and if you know enough you can easily hide malicious things inside a seemingly harmless script. It is possible to create a lua sandbox, where all the harmful functions get removed. I've had it in my mod for a long time, and even though nobody really noticed, i'm sure it's safe. The only things you can still do are crash the game and cause horrible lag. So some moderation is still needed (also in case anyone finds a exploit). Probably if you published a save with a custom element, it wouldn't be really published until the script inside was approved by a moderator.

If we are adding custom lua elements, including the lua scripts behind them, we are basically also adding the full ability to embed lua scripts in saves. Because I can easily make an element that adds hooks and loads cracker64's entire tpt multiplayer script, or similar. So we also have to think of the consequences of this, really we should just add the ability to embed any lua script in saves, elements are just one part of this.

Adding lua scripts to saves is something that was planned long ago (See https://powdertoy.co.uk/Scripts.html). tpt even has a command in game to download and run a script from there, except nobody can add new scripts anyway. boxmein's is a lot more complete I think, but I've never really seen it to know how it works.

In the end it might be too dangerous to allow people to mess with the game from scripts. I'm probably the dev that's most for it, I don't know what the others think. It needs a lot of server side changes to ever get done though, which means it probably can't ever be done.

Edit: I'd also like the mention that if you have a custom lua element and make a save with it, anyone that loads the save that also has the script already on their computer will be able to open / use it.