If you can confirm to those constraints, you can securely ship UI code that automatically runs on computers all over the world, which wasn't a thing before the web.
Smalltalk-80 had a platform independent VM in 1980. If you want to be more recent, Java. Why is there so much confusion about how the web fits into things?
The Smalltalk-80 VM is certainly interesting but as far as I know it wasn't allowing users to run untrusted, possibly malicious code. Taking security seriously came later.
Java was a pioneer with shipping untrusted code to users in a sandbox, but it turns out its sandbox wasn't secure, and there were other UI issues as well. (Similarly with Flash, though that was more of a mobile performance issue.)
To be fair, the early web had a lot of security problems. What we have now is what's left after a lot of hardening. And we still have a lot of security issues.
But anyway, if you use JavaScript this isn't really your problem. Browsers take care of sandboxing and deployment for you. Nothing wrong with building on the hard work of others.
The performance problems were because of the way that specific VM was designed, not because it was a VM. You can easily have sub-millisecond initialization time on a VM if you make it a design goal.
