Don't know much about TCL. But, if you are familiar with JavaScript, Lua ended up being semantically a much cleaner, simpler JS without all the WOT?? and committees to please.
It is small, fast, simple, powerful and easy to embed.
It's also very easy to contain in that the standard library is small and most of that can be removed easily. Isolating Lua's allocation arena and controlling Lua's GC is pretty easy.
All the little operators that make things nice like += are missing. Their object implementation is meta-tables, so every single codebase does stuff in fundamentally different paradigms. Operator overloading in such a dynamic language makes things extremely hard to understand. While `"0" == 0` is false, the language will still sloppily convert between floats and ints and will also convert strings to numbers in other places. Worst of all, array indexes are base 1.
mpv supports both Lua and Javascript scripting, with more or less the same API for both. The wiki lists 10 scripts from the community written in Javascript vs a few hundred written in Lua. There are probably network effects in play; people choose Lua because that allows them to mine snippets of code from a larger collection of userscripts. Even so though, I think it's a testament to Lua.
It is small, fast, simple, powerful and easy to embed.
It's also very easy to contain in that the standard library is small and most of that can be removed easily. Isolating Lua's allocation arena and controlling Lua's GC is pretty easy.