Seems to me that it's potentially safer to run untrusted WebAssembly applications than native Linux binaries, since the format is designed to run in browsers without pre-approval by the user and/or reviewers. So you could run a service published by a third-party on your own Kubernetes cluster alongside your own apps.