The core WA principle of "protect the host from the program, but not the program from itself" still holds, based on the video this paper does not even attempt t

The core WA principle of "protect the host from the program, but not the program from itself" still holds, based on the video this paper does not even attempt to break the WASM host memory barrier. That seems more like a success than anything else. Guess what: developers are still responsible for avoiding security bugs in their code. But at least when they mess up, it still won't damage more than what their dumb web app could have done already.