Is this still true for an application like VLC compiling to WebAssembly that uses other downstream libraries? What if VLC uses downstream libx and Audacity als

Is this still true for an application like VLC compiling to WebAssembly that uses other downstream libraries? What if VLC uses downstream libx and Audacity also uses downstream libx and downstream libx has a critical 0day. I'm not super clear yet on how the WebAssembly build pipelines works. Is dynamic linking done through script tags? or are the binary blobs statically compiled? I'm genuinely curious here how this is all supposed to work. How does one ensure that downstream libx is updated for all of the WebAssembly applications that use them.