Yes, exactly. We wrote an article here regarding PHP on Wasm that covers that: https://wasmlabs.dev/articles/mitigating-php-vulnerabilities...

It does what WASM is meant to do: it allows extra functionality, such as a database, without exposing more surface area for exploits.

They can still destroy your site, they just can't destroy anything else on the same server.