A game which uses WASM plugins for modding would define its own 'system interface', basically an extremely restricted API to only access moddable game features but not allow access to any 'operating system services'.

It's very similar to how games would use a restricted subset of Lua which can only call into scripting APIs provided by the game, but not use random Lua stdlib features (like reading/writing files).