I don't think it was a very effective sandbox at the time Java applets were being used, meaning there were bugs and other glaring security issues. Wasm has the same sandboxing as javascript, which is pretty well worn in and not slow for the user (partly because of faster hardware now). It's not simply a repeat of java in the browser, or the RCE exploit that was flash.

yes.

Not really, a Java applet could load and call into native DLLs, and once you're in native code, you can do pretty much anything on Windows.

The security model for Java did not include calling native DLLs. That was something that Microsoft added, essentially tossing away the security model in the interest of trying to create a proprietary advantage for Windows in a Java world.

Optionally.