Read-side plugins are the half everyone skips. I run strfry plus a router and the write-side filtering is solved — it is the REQ bandwidth that has no lever at all right now.
One ask from the ops side: make a failing filter fail LOUD. A wasm filter that errors and quietly returns an empty set is indistinguishable from a relay that simply has nothing to say, and you will debug the wrong layer for a week.