> As far as I know, people don't ship code to remote Lua VMs and execute it.

So, you never used some software scripted with Lua? Or just never shared scripts?

Lua does have other uses, but the vast majority of it is as a low trust VM.