As I've pointed out elsewhere in these comments, XPC isn't required for supporting plugins in a sandboxed application, and it's possible for plugins to exist within a signed and sandboxed app's bundle:

http://news.ycombinator.com/item?id=3193354

http://news.ycombinator.com/item?id=3193379

http://news.ycombinator.com/item?id=3193404