Wasm could start out as a "function runner" box with no outside interface at all besides arguments and return value, with everything UI, storage or networking conveniently out of scope. Applet, in its day, had to be so much more than just the bytecode VM...
That were applets (used for a very different web than today). The JVM format/vm itself can also work as a simple “function runner”, hell, without adding actual functionality you pretty much get this automatically from any runtime. Most brainfuck interpreters are trivially safe from deleting your hard drive, they simply don’t have fs access.
