While I mostly agree with you, let me play the devil a bit (just for fun!) Let's agree with the base that (probably) most of the bugs will happen within the ho

While I mostly agree with you, let me play the devil a bit (just for fun!) Let's agree with the base that (probably) most of the bugs will happen within the host defined imports (aka bugs in the systemcalls/kernel) vs bugs on the Wasm runtime per se. In that front, Wasm host system call implementations will offer not that much advantage compared to other virtualization approaches such as Firecracker. However, those advantages are only perceived when you run software that's already fully containerized (in a OCI-like container). But here's the nit: there's many more software that is not containerized (for example: 3rd party libraries). Running this libraries in Wasm can actually be more secure than running the native ones (since we are bringing Firecracker-like security to the systemcalls the library may use). Specially, when running this software locally. So, in my view, Wasm forces most of the software to be secure, regardless of its kind (library or application/OCI-container). It's a small thing that might make a big difference!