> What do you do when the client has WebAssembly disabled?

Do people really do that? -- disable, not just using old browsers with no wasm.

Disabling wasm while keeping js enabled is a configuration i can't understand

It’s easy to imagine an organization with a paranoid security posture ending up with that configuration because they decided to only enable a minimum necessary feature set where they determined that JS was necessary while WASM was not.

iOS Lockdown Mode also implements this configuration.