Looks like a symptom of a bigger problem. That's just trying to access cached plugin objects, which aren't there for some reason. Will know more once PHP 7.3 wampserver with updated xdebug module is available and having done some testing, but that probably won't be this month as we're busy integrating with Joomla privacy suite first.

scandir is not dangerous and is necessary for the package installer to find available packages to install. It's used in core Joomla (templates), CB (package installer and finding image field defaults), and several other extensions (e.g. k2 finder). The only way I can see scandir being a security risk is if the server is configured wrong to begin with, which would make opendir, readdir, etc.. also just as risky.

To solve the problem you need to remove it from the disabled functions list in php.ini. Contact your host regarding this.

You'll need to take that up with your web host. scandir is not dangerous. There's no reason for it to be disabled. It can't access root and even if disabled they could just use DirectoryIterator. Entirely pointless for a host to disable.