Firefox has a nice solution which gives an extra layer of sandboxing which can be applied to individual libraries rather than a whole process: https://hacks.mozilla.org/2021/12/webassembly-and-back-again...
One example: that’s great for Firefox but that helps a format become more common, which increases the likelihood of tools integrating a library but not using a browser-grade sandbox. How many apps end up passing user uploads through something like ImageMagick, for example? (And how many years will it be before the last container image is updated?)
(I've contributed to wasm2c and think it's a cool tool.)