Distributed systems are designed (for better or worth) on the idea of non-malicious nodes.

Those that aren't have an extremely limited API - that would be logically not dissimilar from "untrusted wasm talks to more trusted JS".