V8 is still very hard to escape -- an escape is a remote hole in Chrome isn't it? To be honest, I'm happy to base my security on "as safe as Chrome".
v8 is a pretty good security boundary, but to be as secure as Chrome you need the other layers too.
Chrome (all web browsers) have a massive and ancient attack surface -- all of HTML, JS, CSS, every DOM and web platform API, every image codec, video, and on and on and on.
CF workers have a comparatively minuscule attack surface that takes into account all the most recent lessons (high-res timers, for example).
So yeah, if we call Chrome of 2008 a baseline, then Chrome's more recent process isolation increases security. But so to does CF's much reduced attack surface.
Reducing the JS API surface might reduce the probability of finding a way out, but it doesn't reduce the blast radius. 2008 was also 14 years ago, I'm not sure that's the right bar for security!
The OP was also speaking to using v8 getting you the same level of security as Chrome, not to architectural decisions in CF beyond that.
Maybe. Chrome has a lot of extra security hardening you don't get if you are just running the V8 engine alone.
The going rate for a V8 escape is probably around $100k at the moment. Totally worth it financially to snarf credit cards from all the sites on Cloudflare.
Example: there is no notification when your worker is unloading. It just dies. This is sometimes annoying as a developer, but it's the kind of decision a platform makes when it wants (needs) to be able to shut down code arbitrarily and restart it later on a different version of the platform.