This is the killer use-case outside of the web. Embedding untrusted/semi-trusted code into a bigger application or runtime and exposing a specific API to it.