Indeed, there are definitely different use cases for config files, with different levels of trust - from "only the sysadmin should be able to edit this, so if they put something stupid in there, that's their own fault" to "anything the user runs could potentially put something stupid in here" to "people will be downloading these and expecting them to be trustable", and also from "this script should have the ability to do just about anything" (things like changing the locale, setting resource limits) to "this script is expected to only use the provided functions to describe an object". Depending on the use case you might want more or less sandboxing, or none at all.
Assigning resource limits to the process is certainly one solution, but that applies to the entire process. Is it possible to remove those limits after reading the config? Once a process drops root privileges, AFAIK it can't get them back, because that would defeat the entire purpose (once malicious code had taken over the process, it could just re-request root privileges). Does the same not apply to resource limits?
