I think you’re trying to handwave at someone who knows more about the steganographic watermarking approach than you do.

Yes. The sandbox gets whatever capabilities you expose to it.

I had a small X.25 network as combination coffee-table and space-heater at one point; this was before most homes had internet. It almost cost me a divorce.

Doesn’t need to be a “traditional” container. Modulo noisy-neighbour issues, wasm sandboxing could potentially offer an order of magnitude better density (depending on what you’re running; this might be more suited to specific tasks than providing a substrate for a general-purpose conpute service).

That’s not correct, but it shouldn’t preclude you from applying defence in depth.