No, repolfx didn't. There were some security bugs with WASM, but why shouldn't have that happened with Java Bytecode? Also the JVM isn't immune to security bugs either.
WASM still needs to prove itself in similar scenarios.
"Fine-tuning security" is typically symptomatic of bad security design. Security is not a separable concern.
I will read the paper later on.