[sroussey]

The attacks would not be possible against a runtime written in JavaScript as well, by that reasoning.

[kevingadd]

That's called self-hosting, and it's widely used in JS runtimes to implement various built-ins instead of writing them in C++. It provides superior safety and the ability to inline builtins into their callers.

[olliej]

Haha, I wish I had come up with that response :)