Great now explain that to granny on her phone.

Seems like you're moving the goalposts...

Webassembly is clearly an improvement over the old plugins. For one thing it's a full virtual machine and was designed with sandboxing in mind.

Not at all, I say it can be disabled and stand by it.

Those browser flags aren't something Joe and Jane users are capable to be aware of, can disappear at any time anyway, and are not a thing on mobile devices.

A sandboxing that isn't bullet proof and can still be exploited by triggering memory corruption on the linear memory segment, thus changing decisions based on the data contents.

Joe and Jane also don't know or care what WebAssembly is.