You are right about mostly everything except all the flaws of C/C++ making it into Wasm. Wasm still has CFI (Control Flow Integrity) and if you don't take the a

You are right about mostly everything except all the flaws of C/C++ making it into Wasm. Wasm still has CFI (Control Flow Integrity) and if you don't take the address of a stack variable, no C stack entry will be made, so much of the stack is invisible to user code (C/C++ code). You can still corrupt memory, you can't implement ROP or subvert control flow in a non data-dependent way.