> It probably makes sense if you're running untrusted code or handling untrusted data

I never understood this because... I feel like wasm (the standard) is an empty box and a lot of runtimes help you attach things to it / make it useful (able to read/write to filesystem, call the Internet, etc.)