Java failed because of its security model - trying to run trusted and untrusted code in the same VM without a hard boundary - a given call is trusted if every call stack entry at the time of the call is in a trusted class. There were too many confused deputies - if you can set up a trusted object to make a call that requires trust later on without your involvement, then you have privilege escalation.
The solution was to sandbox the whole VM but this breaks all the existing code designed for partial sandboxing (e.g. most of the standard library). WASM uses this approach from the start.
Again: Microsoft. Microsoft actually promoted their own version of "fine-grained permissions" before Sun released JDK 1.2 just to make it incompatible. Customers did not care abut security. Microsoft provided shortcut to speed. Sun already lost.
Don't be surprised if Google adds something similar to Chrome for WASM.
The solution was to sandbox the whole VM but this breaks all the existing code designed for partial sandboxing (e.g. most of the standard library). WASM uses this approach from the start.