Web Assembly is just a runtime, like obfuscated JS it is sandboxed and still needs to access some standard APIs to at least conform to CORS. I don't see a problem to let plugins/browsers control `window.fetch` or whatever connection method the WASM code is going to use.