Any popular VM inevitably becomes as complex as those. Look at V8, it's grown into a JVM sized beast.
It would save countless hours of human effort to just adapt what's out there. It will be a decade before WASM has the kind of support JVM and CLR do. By then it will have the same huge codebase that causes vulnerabilities
Many of us consider these points to be features. We don't want a runtime that's as complicated as CLR or JVM bytecode.