Agreed - the Deno model doesn't bring much security, because you have to grant all code in the whole app the same permissions, which for any non-trivial app will amount to "mostly everything".

First class capabilities are a much better approach, a real solution to supply chain attacks.