I believe that wasm is not particularly focused on functional security as much as embeddable security.

Essentially the promise here is that you can download a random wasm from anywhere, run it with little-to-none privileges and be sure nothing bad can happen.

There was an article here many months ago detailing how wasm on the server makes it harder to mitigate attacks due to lack of wasm-inspecting tooling compared to system utilities for processes/native binaries.

But in part that is because the attack model of wasm is "literally executing malicious code".