Yes, if it comes from some reliable partner I can report bugs to, or something built in-house. In such environment probably fine. And maybe thats the main audience and not some open data exchange format where your system may be brought down by someone's random decoder.
But the WASM is integrated into the file. So what scenario would happen where the decode fails? They wrote a file, wrote a wasm decoder, and didn't test the decoder against the file they just wrote? I think it would be a natural step as part of the publish pipeline to run the decoder against the file and compare the output against the source to ensure correctness.
Thats what a reliable party would do certainly, which was my point above. But there is no guarantee really. And there may be people testing their decoder on some test data then attaching it to whatever data they send without testing edge cases. Its like testing recovery from backups, people who care do it, many people dont.
