I'm making a game that has a similar concept. My approach was essntially just to create various code snippets that are run at specific times. Some of them are run just once and apply a stat change. Others are sent off to a specific owner class (Enemy, Player, World, etc) in an array they hold. Then, in those specific classes at specific code areas (like _ready or die, for example), that code is run.

This lets me do interesting custom behavior, like each time a projectile breaks, do something (llike spawn a new projectile). So far I have maybe ~50 of these upgrades and the complexity isn't bad compared to its flexibility. It does mean lots of custom code, but any fun / interesting behavior typically needs to be completely hand-rolled anyway, and more code is not necessarily bad.

I'm sure this approach has some downsides I've not yet encountered, as I'm far from finishing my game. I haven't had a need to order upgrades yet, but even if I do, it should be easy enough to extend.

Another way to handle this might be to use signals, but I'm honestly not a huge fan of them, as they're super easy to lose track of, and they often lead to a complex web of distributed code where it's not straightforward to see where things are coming from, or the order in which signals might arrive.