The safety argument for JS leaves out how much of the browser's real attack surface is actually the DOM and built-ins, not just the scripting lang. WASM can be sandboxed as tightly as you want by the engine, by default it has zero access to DOM or JS internals unless explicitely wired up. Plus, JITing objects and dynamic code in JS opens a totally different can of worms for exploit chains on various engines. If anything, betting security on dynamic typing being always safest in every runtime feels like chasing ghosts at this point.