for instance, we can have a plugin that queries a website and puts the JSON data into an AM, maybe it gets good data, maybe server error, but if we can be assured that it actually made the query then we can trust the data in the AM.
Again *we can't know it made the query* all we can do is have peers check the results - but I don't see why we really care if one peer did or didn't honestly do what it was asked.
Basically it is the same problem that happens when peers decide to say accept a transaction that lets an account have a negative balance - the result is you'll end up with a "fork".
If you just treat the scripts the same as normal transactions in this way you'll see that there simply is no need to try and do "magical things" to verify them.
I thought you said NXTplugins wont work because we cant verify that Evil bob didnt make a version that is lying.