Well, easier... except that your hypothetical insecure WASM program has virtually no I/O, so pretty much every exploit is going to need some kind of extra indir

Well, easier... except that your hypothetical insecure WASM program has virtually no I/O, so pretty much every exploit is going to need some kind of extra indirection to even get into the WASM program - and once hacked, that WASM program again can barely interact with anything, meaning that again expoitability is going to be pretty situational. I suppose a native program might also have a sandbox that's as restrictive, but that's not exactly common.