but you can relatively easily sandbox anything you want and close all escape hatches. If you want to turn off the monkeypatching functionality, that's just a metatable or two away. I can and regularly disable monkeypatching on some of my libraries (especially where it interacts with c++ interop). JS now has proxy objects, but lua has been able to do this since way before
And also those stackful coroutines, would have made callback hell non-existent, and no async/await function coloring either (as long as you started one coroutine somewhere up the call stack.