It's a meaningless point in the chain. Browser security is not intended to be only for running "trusted" or known JavaScript or WebAssembly code and hence competitions like Pwn2Own are perfectly happy to have you navigate to your own page that then runs whatever WASM or JS you want. Nobody requires you to first find an XSS on HN for your exploit because getting someone to load a random page is an extremely low barrier.