WebAssembly just had its 7th anniversary. If it hasn't happened yet, it probably won't happen at any time in the future.

And I think this hasn't happened because it wouldn't work with the "ad mafia" business model. Embedding hardwired ads into a WASM blob of an application doesn't make any business sense just as it doesn't make business sense to host ads locally from your own server. Instead ads are typically injected from an external ad network, and those requests can be filtered even when they are coming out of a WASM blob.

As for the malware comment: WASM isn't any different from minified Javascript in that regard.