But if WASM can call JS, and JS can then interact with the DOM, then doesn't tat allow WASM to exploit security holes in the DOM?