The fact that WASM is NOT a programmimg language, and that WASM is intrinsically sandboxed and has really granular permissions (through WASI).
Also, how do you expect that, for example, a videoconference site (let’s say, Jitsi Meet) will work if you don’t execute any client-side code? And I’m not saying that all client-side code is permisible, justified or good, but rather that not all the client-side code is unpermisible, unjustified or bad, as you seem to imply.
And if you do use FLOSS, that’s really paranoid, even if FLOSS isn’t perfect.
*A wild Systemd spawns*