What's the performance overhead in comparison to the unsandboxed version I wonder?
https://kripken.github.io/blog/wasm/2020/07/27/wasmboxc.html
tl;dr Something like ~14% when using the best bounds checking strategy, or ~42% when using the most portable one. (There are options in the middle as well.)