> Channel Programs may only be run with root privileges

Compare to eBPF, which not only uses a JIT compiler in the kernel, but on popular Linux distributions like Fedora and Ubuntu permits unprivileged users to run eBPF programs.

I would never assume a lack of exploitable bugs in the fork of the Lua interpreter used in FreeBSD, but the fact is that eBPF has seen a steady, if infrequent, stream of actual exploits over the years and in particular unprivileged user exploits.

lua is significantly MORE powerful than eBPF not less, and correspondingly will be easier to build exploits in.

If you have to have root already this doesn’t buy you much though. Perhaps a hard-to-detect way for disgruntled bofhs to do bad things, that’s about it.