It will sit on top of the existing JavaScript engines and APIs, so no new security issues there.

This is no issue of language, this is issue of APIs and runtimes. Binary serialization of code has to do very little with security.

No. Categorically not. Is this intentional FUD or can't you discriminate between a program in source and compiled forms?

As if the parser of JavaScript source code can't have security issues.