But Wasm has deterministic execution, so if decode fails for you, it should have failed for them. I.e. it's not a problem that your system has introduced; they should be able to reproduce the failure independent of any client.

Yes, if it comes from some reliable partner I can report bugs to, or something built in-house. In such environment probably fine. And maybe thats the main audience and not some open data exchange format where your system may be brought down by someone's random decoder.