Another option (as suggested in MDEV-19852) would be to run them on INSTALL/UNINSTALL PLUGIN.

That might work if there's an SQL scriptlet to run. But it cannot do a shell scriptlet.

shell scriptlets can be used by pam plugin to fix filesystem permissions

running from rpm/deb:
run when a plugin package (or a server package with a plugin) is installed
run on upgrades too
somewhat different code for rpms and debs
bintar packages can only do it from mysql_install_db
mysql_install_db doesn't handle upgrades. mysql_upgrade ?
sql scriptlets need a running server
Should a plugin be active when its sql scriptlet is run? or is a scriptlet a prerequisite for a plugin being able to start?

running sql scriptlets by the server on INSTALL PLUGIN:
uniform treatment for rpm/deb/bintar
needs a new version column in mysql.plugin to detect upgrades
doesn't support shell scriptlets (but it can run wsrep scripts, so why not?)
--plugin-load is treated like installing on every server startup (up to the script to detect it?)