Reading about that and the JS runtime just handing out a view into a shared mutable buffer just floored me.

That’s so clear dangerous from both a bug and security perspective.