Java applets needed to interact with the OS in various ways and required browsers to have sub views controlled by plugins. They were a lot more complex and risk prone. Especially since Sun kept adding features.

WASM is much simpler. It's just a standard bytecode format that the JS engine can handle. It's much easier to secure.

WASM feels like an evolution built on top of a lot of what's worked with Javascript.

From a security perspective, how is this any different from what you can already do with asm.js? (Remember, SpiderMonkey has a separate JIT mode for it.)

This isn't a plugin. It also doesn't have the same privileges as the browser itself.