Thread on spectre and capability security (which I gather from a glance here that wasmtime is using on some level https://github.com/bytecodealliance/wasmtime/blob/main/docs/...):

https://groups.google.com/g/cap-talk/c/NSDM-05fEuU/