Why wouldn't it? It's a different technology stack, developed with the benefit of decades of additional experience running hostile code on the web.

You mean like the CLR?

Kind of strange that such experience still allows for WASM to be the target of C and C++ compilers, and there is no bounds checking support inside linear memory regions.