Let me first thank you for the incredibly important work of finding and documenting behaviour of hardware we use. I see your point. However, if it's harder for

Let me first thank you for the incredibly important work of finding and documenting behaviour of hardware we use. I see your point. However, if it's harder for the attacker, it is already a win. Also, this is just one example where JavaScript/WebAssembly are used to deliver/activate malware. There are many other examples. Besides that, even if JavaScript/WebAssembly implementations were provably secure (which they aren't), I would be against them for the other reasons I described in other comments here.