It is well known that hackers have ways of loading arbitrary scripts to do arbitrary things, like impersonate a message to my extensions, and I will assume this will remain true to at least some extent despite best efforts.

My suggestion is that arma3,
On mission end:

  for each extension:
    if extension has "RVExtension_Ended" then call it

There must be no way to invoke that function from a script outside of actually terminating the mission. This is the crucial bit, because other than that, we would simply use https://community.bistudio.com/wiki/Arma_3:_Event_Handlers#Ended

Such an event is an excellent opportunity to clean up resources held that are only needed for the mission that just ended, but if done falsely could create a lot of problems.

It could also be used to allow mission-start calls in mods and missions, making them otherwise prohibited for similar reasons. E.g. If the mission can specify what database to connect to, an attacker could no longer redirect it to his own.