So with wasm, traditional buffer overflow type stuff becomes xss.

I guess that's a concern, but im not sure its that big of one relative to normal xss.