Wasm has more control over time and memory access than JS does. From a capabilities model, it is more secure, but from a threat model due to side channels, Wasm is a more effective tool than JS.

This thread discusses SAB (shared array buffer) and Wasm side channels https://github.com/tc39/security/issues/3

But to compensate those tricky features are sandboxed much more rigorously than JS is, e.g. https://developer.chrome.com/blog/enabling-shared-array-buff... - no SAB without site isolation.