"Still under development: do not use for production systems yet, there are known security holes that need to be closed."

Also note the experience of Figma who used the realms shim I think this project is using to secure Figma's JS based plug-ins system, only to promptly take a different approach when compromises were identified:

https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...

https://www.figma.com/blog/an-update-on-plugin-security/

I am looking forward to Realms. Until then, I am doubtful of attempts to fully secure third party JS execution in the browser's engine.