My first thoughts exactly. How do you prevent this from turning into what we had with flash if you don't provide the framework to build the UI components.
The design behind WASM helps keep this iteration of Macromedia/Flash/Java/ActiveX stay quite secure, at least until people start adding the extra APIs that a certain subset of WASM enthusiasts trying to turn WASM into another JVM are going for.