The sandbox gives a false sense of security, because it opens a new attack vector.
Apparently you fail to understand how security exploits are taken.
For example, lets say I have an authentication module provided as WebAssembly, written in C.
The browser makes use of the said WebAssembly module to authenticate the user.
Now we make a cross site scripting attack that calls the WebAssembly functions in a sequence that triggers memory corruption inside of the module, thus influencing how the authentication functions work.
Afterwards the JavaScript functions that call those WebAssembly ones, might authenticate a bad user that would otherwise be denied access.
A contrived scenario that can be easily programmed in https://webassembly.studio/ .