Javascript and Web Assembly are only dangerous because of this insane policy on the web that everything is whitelisted by default. Fortunately there are extensions to change that behavior but most people won't bother with them, leading web developers to assume that JS is enabled and the site breaking if it's not.

In our rush to get rid of Flash on the web we turned the web into Flash. At least it's an open standard now, I suppose.

Images and other codecs might also be an issue but it seems like a more complicated attack vector and one that could be mitigated more effectively.