Because, Truffle is reused in multiple language VMs their overall attack surface is smaller than it would be with classical language VM architectures.