“workerd is not, on its own, a secure way to run possibly-malicious code.”
Cloudflare open sourced the runtime behind Workers under Apache 2.0. You can self-host it, but the sandboxing that makes Workers safe for strangers’ code is not included. Lock-in fears were the main objection to building on Workers. This answers the objection and keeps the hard part in Cloudflare’s data centers.