The change would be using Gitmail as the plumbing, and normalising the creation of user-friendly porcelain on top.
E.g. suppose there is a repo foo/bar hosted by a forgejo instance at myinstance.org/foo/bar. Sending an email to foo.bar@myinstance.org (or similar) could automatically create a PR and, conversely, opening a PR could send a patch series to the foo/bar mailing list.
Well now I'm nervous! My first instinct though is that the vast majority of Emacs packages are plain elisp, and Emacs users have a habit of cracking open and tinkering with their packages, so any malicious code ought to be spotted quickly.
With the native compiled modules however, it could be another story...