Hey @jecko,
Someone can correct me if I’m wrong– I believe you can manually add plugins through the local dev only, and those aren’t setup to push to staging/production unless they’re installed to composer.
As far as Polylang goes, I don’t think there should be a problem. If it’s a huge concern, you may want to look into managed db backups.
You can tie in Polylang through wpackagist, which is convenient.
Although it looks like WPML is a roots recommended plugin that does the same thing.