I wonder if it's because they didn't want user code to have access to browser APIs, to avoid inadvertently growing dependencies on them.

edit: they explain all the rationale here and it makes a lot of sense to me:

https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...