Partitioning memory-unsafe code into lots of little OS or WASM sandboxes each running with least-privilege would be interesting, but I think it would get really

Partitioning memory-unsafe code into lots of little OS or WASM sandboxes each running with least-privilege would be interesting, but I think it would get really costly at runtime and at development time, because they all have to have disjoint address spaces one way or another and managing the privileges gets crazy. We don't see people actually doing this in practice (although some WASM people are thinking about it). You would have to be very aggressive about making the partitioning as fine as necessary, otherwise memory unsafety leads to privilege escalation. For example if memory unsafe code in a single sandbox can download arbitrary PDFs and render them, then a malicious PDF will be able to scan scan local networks and exfiltrate data.