Comment by KMnO4

We already allow arbitrary code to execute by clicking a link, in the form of JavaScript.

You may argue that JS is sandboxed, but so is DOSBox. At least DOSBox can’t easily connect to remote servers over the internet.