Seriously, if the security of nethack is critical to your security, then you probably do something very wrong. There is no reason to not sandbox the hell out of it.
You don't have to spin up a VM per user to sandbox on Linux. You could use firejail. But traditional UNIX user sandboxing could also go a long way.
I'm just saying that I would never trust nethack to not execute arbitrary code and I would have other security measures in place if my threat model required it. It's written in C. I don't expect most contributors to be security focuesed. The primary use is a user running it on their own machine, which is a completely different threat model.
