WASM won't be able to get any real level of adoption if you have to specifically write all your code to target it, which I think is what would happen if the sandbox is too restrictive.

If you can trivially move existing code to run in a WASM VM you get the benefits of isolation and a convenient artifact to move around for deployment and scheduling.

I think the history of successful platforms are ones that still supported the old way of doing things, while enabling a new and better way. Of course that comes with lots of tradeoffs that are often hard to stomach.