I'm not overly concerned that allow-run leads to possible elevation, I'm more interested if:

  > deno run --allow-read=./assets

works as intended - preventing most execution of local code, and prevents writing to disk. I think it's a useful real-world use-case, that is complicated to copy with nodejs.

That said, I think one should still be wary of running random code - but at least deno makes it a little easier for honest authors to adhere to principle of least privilege?