Many holes were discovered in Native Client. Difference is that Google was willing to fix them as they were discovered.

For example, https://developer.chrome.com/native-client/community/securit... lists 20 holes. I think the actual number of explicitly discovered holes in CPython and Lua bytecodes are each less than 20, and that was enough for them to give up.