How can isolation strategy mode actually improve security?

[segevfiner]

If all it does is pass message to an isolated JS function that can do validation at best? After all, such validation can also be done at Rust side, how will having another layer here add any security to an app?