[cesarb]

> libjxl is written in C++ so undoubtedly will be full of undiscovered security issues.

There's the WebAssembly sandboxing trick (https://hacks.mozilla.org/2021/12/webassembly-and-back-again...) which might mitigate that, but an image decoder might fall into the "too performance-sensitive to accept the modest overhead incurred" case.