All of that applies to JavaScript again. Wasm is just lower level and simpler. If anything it should be significantly easier to sandbox because of its simplicity. It doesn't provide any more access to Apis or anything than JavaScript does.