Perhaps counterintuitively, this is exactly the sort of usecase WASM is meant for. A VM that needs to be simultaneously lightweight/cheap and very high performa

Perhaps counterintuitively, this is exactly the sort of usecase WASM is meant for. A VM that needs to be simultaneously lightweight/cheap and very high performance (because it's being used to do the heavy lifting for a slower/heavier runtime), but is still expected to run untrusted code and is therefore thoroughly sandboxed.