That incorrect results might lead to security exploits, the same way that browsers now get exploited by taking advantage how their VMs work.
So hand waving such security issues is rather strange, when it should be the top concern when selling an infrastructure to run code from unknown sources.
> the same way that browsers now get exploited by taking advantage how their VMs work
The difference is if the exploit is run by the browser or the VM. If the VM has a logic error, gives back the wrong result, the browser decides to trust the result and be exploited then it is a browser bug; not a sandbox issue.
The other situation is when a browser spins up a VM to add 2 and 2 but then the VM starts downloading malicious files from the internet.
No kind of safe language can avoid the first class, wasm avoids the second.
So hand waving such security issues is rather strange, when it should be the top concern when selling an infrastructure to run code from unknown sources.