I agree that the paper's title is somewhat overblown, especially the prefix "Everything Old Is New Again". Specifically, "old" things like all VM runtimes being directly vulnerable to malicious code is not carried over by WA -- to the contrary, WA seems to have captial-S Solved this problem which is certainly an advance.

That said, it does highlight that memory-safe source languages and other program exploit mitigations are still important even in a webassembly sandbox. Personally I wasn't confused about this fact, but it does clarify this point for any that might think that WA == no more security problems in any context.