This article reads like AI and lacks coherence in crucial parts of the attempted “explanation”, specifically:

TypeScript compiler checks the code: ✓ Types match (at compile-time)

I’m not even sure whether there’s a defense against this when trying to limit the user to a subset of JavaScript. It feels like you need to write a compiler or interpreter that doesn’t know anything outside of that subset otherwise you can break out of the language sandbox.