With POSIX and the like we do security mostly by disabling things. By default a program can break into your browser and steal your saved credit card number, and you're trying to figure out how to block that.
With something like WASM you need to specifically make available an API to the code running inside. So if it shouldn't open files, you never give it a file API in the first place. You're under full control of what the code can work with, and it never expands without your knowledge, like when the kernel acquires a new feature.
The great satan of computing is backward compatibility. It’s almost always why we can’t have nice things.
Otherwise you are confined to greenfield projects only, and to only the subset of the project that is greenfield.
And thus, in one fell swoop, defeat the very core purpose of WASM.
The only reason for using WASM is that it does NOT allow access to all the system resources by default. It denies all access, which is a very good thing. Actual working, implemented, widely available, Capability Based Security is an exceedingly rare and precious resource that appears and tends to rapidly wink back out of existence due to cries to "speed up" or "make more compatible" such platforms.
The beauty of WASM is that you can run ANY WASM code, no matter how confused, buggy, or evil, and it can not ever access resources you didn't explicitly give it access to from the outside.
The closest real world analogy I've found (so far) is that of cash in a wallet. If you want to buy something for $4.50, and you hand over $5.00 (an economic capability), you can't somehow accidentally give away your house and car in the process, nor does that cause the other party to permanently gain access to your banking account.... unlike using a credit card could.
The current horrible POSIX model of security is to hand over your wallet, and sign a non-revocable power of attorney to make a simple $5 purchase. The program gets ALL of your Authority by default, which is nuts.
----
This seems more like fuzzing the optimization options on a compiler and keeping all the results, and seeing which works best at run-time. As far as I can tell, all the code is native code, unlike WASM.