Perhaps wasm isn't (yet) a good replacement for native binaries for the reasons they mention. In particular such an application usually has access to files and timing etc., and you're (currently) missing some safety techniques native binaries use, which is a risky combination.
But as mentioned in the post here, if you're sandboxing a specific library that does pure computation (say, a codec or a compression library) then using wasm you can make sure it cannot escape the sandbox and that it has no timing or other OS capabilities. Those are powerful guarantees!
Pure computation is subject to UB and memory corruption due to lacks of bounds checking inside linear memory blocks, leading to outputs that cannot be trusted, even though they are sandboxed.
"Everything Old is New Again: Binary Security of WebAssembly" - USENIX 2020
https://www.usenix.org/conference/usenixsecurity20/presentat...