Ah, maybe I wasn't clear enough there -- the validator/analyser is supposed to run by both parties, the party who writes config, and the party who loads it as well. So you can reject a malicious config before trying to execute it.

I mostly have a non-malicious user in mind though (i.e. end-user software, where the software and the config have same permissions)

If you do have such security concerns, you probably need a sandbox at some point. E.g. big source of my frustration are CI pipelines -- they run isolated anyway and execute arbitrary code. Having a YAML there does nothing for the security.