It is possible that there are a lot of tool to examine JS code for "suspicious code" and that those tools might not work well on WASM.
In practice the WASM interpreter in the browser is a functionality that can be (almost) completely polyfilled.
Personally I would be way more worries about hardware exploits via WebGL.
But it is probably already possible with JSFuck and webworkers.
It is possible that there are a lot of tool to examine JS code for "suspicious code" and that those tools might not work well on WASM.
In practice the WASM interpreter in the browser is a functionality that can be (almost) completely polyfilled.
Personally I would be way more worries about hardware exploits via WebGL.