You control this list of allowed domains yourself. In addition, this property is optional. If you do not add this property to your manifest, then by default you will be able to make network requests to any domains (equivalent to "allowedDomains": ["*"]). If your plugin does not make any network requests, then you can specify ["none"]. But this, I think, has nothing to do with uploading to the Figma server.
Yes, compilation is performed by the JavaScript engine on the client side. But Realm seems to still be used for the developer’s VM. Here’s a recent thread on the forum: "Failed to load realm" error when reopened Figma Widget.
And here you can see which open source libraries Figma uses: