WASM binaries needn't be exposed to the internet. That said, the OS-sanctioned runtime could very well support a shared-object-like approach instead of one-bin

WASM binaries needn't be exposed to the internet. That said, the OS-sanctioned runtime could very well support a shared-object-like approach instead of one-binary-per-app but that would 1. complicate the runtime quite a lot 2. hinder startup times of wasm apps due to dependency solving.