> That's how wasm is meant to be, but doesn't give any detail as to how that's achieved programatically

True, but a conforming implementation has at least some sandboxing, since it prevents arbitrary memory access. But the degree to which it is sandboxed depends on the functions that are exposed by the runtime.