WASM uses the current JS/VM environments to leverage its existing infrastructure (i.e. low-level abstraction and security). In practice it is a pre-optimized bytecode that only relies on JS primitives, so it does not need dynamic typing features or GC, i.e. the slowest and least safe parts of JS. Which means that anything compiled to WASM is "near-native" in terms of performance, making the use of a separate VM unnecessary.
If I understood correctly the main reason was ease of implementation for a MVP.
at this point webassembly run in a sorta VM with a security model added.
the fact that wasm and JS share the interpreter should not have (ignoring bugs of the implementation, which is not trivial) a security effect
Isn't this contrary to the whole idea of wasm?
EDIT: this is a completely serious question, I honestly don't understand why this is built into the existing JS engines instead of something separate.