WebAssembly threads mostly depend on SharedArrayBuffer, which was yanked by everyone for security reasons. Chrome rearranged their browser memory model and re-enabled it, which let them deliver this feature while everyone else still has blockers.
> why not pull a Google security style blog post exposing it
Because I don't think publicly exposing specific security problems in shipping software is necessarily the right thing to do.
I'm no security engineer, but isn't it best practice to expose security risks instead of letting them get knowingly exploited, especially if the parent company considers it designed as intended?
There are times when "screw you, I'm going public with this" is in fact the right thing to do. Again, in this particular case I don't think it is.