And you see no problem in that at all? Just “throw a box around it and let the potentially malicious code run”?

Wait until they find a hole. Then good luck.

This is why you can't build these microVM systems to just do isolation, it has to provide more value than that. Observability, policy, etc.