Apple controls the JS sandbox in Safari, whereas they don’t control the ScummVM scripting sandbox. In theory it’d allow the execution of arbitrary scripts that can do anything native code can do, although I don’t know - maybe ScummVM checksums the games you load into it and will only run code it recognizes (and if so, maybe that’s why it’s allowed).