the problem with java wasn't the bytecode so much as everything that's around the bytecode. the JVM security model was based on essentially ACLs and built by subtraction starting from a fully featured desktop runtime; the Wasm security model is based on capabilities and built by addition from nothing
we have, in fact, learned from Java