There's a distinction here between using safe languages to implement a program and allowing an attacker to write code in your safe language and attempting to av

There's a distinction here between using safe languages to implement a program and allowing an attacker to write code in your safe language and attempting to avoid sandbox escape. For example if I wrote a web server in JS or WASM I just made things much harder for someone who connects to port 80 and tries to attack the server through a buffer overflow etc. A lot of the vulnerabilities that you would look for in a C/C++ web server just won't be present. However a modern browser is trying something much more difficult: Letting the attacker write code in the "safe" language and trying to avoid giving them full access to the machine. This is what Flash, Java, JS, and WASM attempt and it's the boss level of defensive security work. The article mixes those up in the intro, but it's an interesting article, especially the use of embedded fp constants to construct shell code.