Also applets were too slow to start with Sun's implementation of the day while wasm works reasonably well in all browsers from day one. That matters a lot for adoption.
JVM improved but applets missed their chance. You only get one.
WASI starts with nothing and then exposes a bit more. WASI2 exposes more than WASI1. Preview 3 will also add more. Eventually there will be sandbox escapes in WASM runtimes as well. There's nothing about WASM that makes sandbox escapes harder.
Bear in mind, applets exposed a large surface area, because you need that to write useful apps. Currently WASI looks useful for, maybe, some subset of CLI tools. Everything else is kicked to Chrome. It's not as ambitious.