As I noted in another comment Figma has used QuickJS to run JS inside Wasm ever since a security vulnerability was discovered in their previous implementation.

In a browser environment it's much easier to sandbox Wasm successfully than to sandbox JS.