My understanding is that you can use WebRTC and other methods of JavaScript to port scan a computer. Heck, you can literally run BitTorrent on a website using WebTorrent. You could force users to download and share copyrighted movies or other illegal material in the background without their knowledge when they visit your website. The state of the browsers is a disaster and security nightmare. Wasm is only going to make it worse. Soon you'll essentially be running binary blobs when you visit a website. What was supposed to be a permissioned sandbox to protect users, turned into an advertisers and malicious hackers' wet dream.
I think there needs to be more alternatives to JavaScript at this point.