The JavaScript VM is also a type of sandbox, whose security in every browser is compromised on a depressingly regular schedule. It's true that the EME sandbox is an additional risk, but it's only supposed to run a single piece of software from (in Firefox's case) Adobe, which is probably not malware, and would thus have to be exploited before the strength of the sandbox made a difference. It probably can be exploited, but considering that attackers can run arbitrary evil JavaScript directly... EME is only a small addition to the overall risk profile.

What I think is more important, from a security perspective, is that EME defeats (or attempts to defeat) attempts to get by without JavaScript or the complexity of modern browsers altogether. YouTube doesn't work as is without JavaScript anyway, but one determined not to use it could just download all their videos with youtube-dl; until someone comes out with a reverse engineered Widevine or Adobe Primetime or whatever other long-i-festooned DRM systems these sites support, this plan won't work for DRMed video.